VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jul 16, 2024· Updated May 12, 2026

CVE-2022-48829

CVE-2022-48829

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value.

Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3().

Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A Linux kernel NFSD vulnerability allows a client to overflow ia_size on the server, causing unexpected behavior when storing large file sizes via NFSv3 SETATTR or CREATE.

Root

Cause

The NFS server (NFSD) in the Linux kernel incorrectly handled very large file sizes in NFSv3 SETATTR and CREATE operations. The iattr::ia_size field is a loff_t (signed 64-bit), but the client could send a value larger than S64_MAX. The code used min_t() to silently cap this value, which could silently corrupt the stored size without returning an error to the client. [1][3]

Exploitation

An authenticated NFSv3 client can send a SETATTR or CREATE request with an ia_size value larger than S64_MAX. The server's decode_sattr3() function would silently reduce the value, leading to a mismatch between the intended and actual file sizes. No special privileges are needed beyond standard NFS write access. [1]

Impact

This inconsistency can result in unexpected file behavior or resource exhaustion. While RFC 1813 only permits the WRITE procedure to return NFS3ERR_FBIG, the patched behavior now rejects oversized sizes with NFS3ERR_FBIG, preventing silent corruption. The issue has moderate security impact (CVSS 5.5). [1]

Mitigation

The vulnerability is fixed in the upstream Linux kernel by commit 604ec6c56ad1 ('NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes'), which removes the min_t() truncation. Users should apply the latest stable kernel updates or backport this patch. Siemens has listed CVE-2022-48829 in its product security advisories for affected industrial devices. [1][2]

References
  1. SSA-355557
  2. SSA-265688
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

123

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.