CVE-2022-49321 (GCVE-0-2022-49321)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-08-05 08:54
VLAI
Title
xprtrdma: treat all calls not a bcall when bc_serv is NULL
Summary
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug message at rpcrdma_bc_receive_call are, [56579.837169] RPC: rpcrdma_bc_receive_call: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdma_bc_receive_call: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 After that, rpcrdma_bc_receive_call will meets NULL pointer as, [ 226.057890] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 ... [ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878] rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] [ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] [ 226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] [ 226.060257] process_one_work+0x1a7/0x360 [ 226.060367] ? create_worker+0x1a0/0x1a0 [ 226.060440] worker_thread+0x30/0x390 [ 226.060500] ? create_worker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10 [ 226.060724] ret_from_fork+0x35/0x40 ...
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 8e3943c50764dc7c5f25911970c3ff062ec1f18c (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 998d35a2aff4b81a1c784f3aa45cd3afff6814c1 (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < da99331fa62131a38a0947a8204c5208de7b0454 (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 8dbae5affbdbf524b48000f9d357925bb001e5f4 (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < a3fc8051ee061e31db13e2fe011e8e0b71a7f815 (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 90c4f73104016748533a5707ecd15930fbeff402 (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 91784f3d77b73885e1b2e6b59d3cbf0de0a1126a (git)
Affected: 63cae47005af51c937f4cdcc4835f29075add2ba , < 11270e7ca268e8d61b5d9e5c3a54bd1550642c9c (git)
Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 4.14.283 , ≤ 4.14.* (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.122 , ≤ 5.10.* (semver)
Unaffected: 5.15.47 , ≤ 5.15.* (semver)
Unaffected: 5.17.15 , ≤ 5.17.* (semver)
Unaffected: 5.18.4 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:43:44.893562Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:56.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e3943c50764dc7c5f25911970c3ff062ec1f18c",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "998d35a2aff4b81a1c784f3aa45cd3afff6814c1",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "da99331fa62131a38a0947a8204c5208de7b0454",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "8dbae5affbdbf524b48000f9d357925bb001e5f4",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "a3fc8051ee061e31db13e2fe011e8e0b71a7f815",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "90c4f73104016748533a5707ecd15930fbeff402",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "91784f3d77b73885e1b2e6b59d3cbf0de0a1126a",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            },
            {
              "lessThan": "11270e7ca268e8d61b5d9e5c3a54bd1550642c9c",
              "status": "affected",
              "version": "63cae47005af51c937f4cdcc4835f29075add2ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/rpc_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: treat all calls not a bcall when bc_serv is NULL\n\nWhen a rdma server returns a fault format reply, nfs v3 client may\ntreats it as a bcall when bc service is not exist.\n\nThe debug message at rpcrdma_bc_receive_call are,\n\n[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID\n00000001, length=20\n[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 04\n\nAfter that, rpcrdma_bc_receive_call will meets NULL pointer as,\n\n[  226.057890] BUG: unable to handle kernel NULL pointer dereference at\n00000000000000c8\n...\n[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20\n...\n[  226.059732] Call Trace:\n[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]\n[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]\n[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]\n[  226.060257]  process_one_work+0x1a7/0x360\n[  226.060367]  ? create_worker+0x1a0/0x1a0\n[  226.060440]  worker_thread+0x30/0x390\n[  226.060500]  ? create_worker+0x1a0/0x1a0\n[  226.060574]  kthread+0x116/0x130\n[  226.060661]  ? kthread_flush_work_fn+0x10/0x10\n[  226.060724]  ret_from_fork+0x35/0x40\n..."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is triggered by crafted RPC-over-RDMA messages delivered from a remote NFS/RDMA peer and handled on the client receive completion path (rpcrdma_wc_receive \u2192 rpcrdma_reply_handler \u2192 rpcrdma_is_bcall). Like other remote-peer protocol processing bugs, this is Network.\nAC:L - The remote peer fully controls the RDMA/RPC header fields used by the misclassification checks (rdma_msg, empty chunk lists, matching XIDs, RPC_CALL) and can reliably send such a message on an established connection; there is no race or other condition outside attacker control.\nPR:N - The attacker is the remote NFS/RDMA server peer and needs no privileges on the vulnerable client; once the client has an RDMA transport, the malicious reply path has no credential or capability gate.\nUI:N - In the highest-impact reasonable deployment (HPC/enterprise clients with existing NFS-over-RDMA mounts), a compromised or malicious server can send the crafted reply during normal operation without any further victim action.\nS:U - Impact is confined to the client host kernel/RPC transport authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The flaw is a pure NULL pointer dereference of xprt-\u003ebc_serv when taking sv_cb_lock; it does not read attacker-influenced memory or otherwise disclose kernel data.\nI:N - There is no memory corruption, write primitive, or control-flow hijack beyond the immediate NULL dereference crash.\nA:H - The NULL dereference causes a kernel oops/panic as shown in the fix commit crash trace (spin_lock on bc_serv-\u003esv_cb_lock), which is a high availability impact and can be repeated by the remote peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:42.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e3943c50764dc7c5f25911970c3ff062ec1f18c"
        },
        {
          "url": "https://git.kernel.org/stable/c/998d35a2aff4b81a1c784f3aa45cd3afff6814c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/da99331fa62131a38a0947a8204c5208de7b0454"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dbae5affbdbf524b48000f9d357925bb001e5f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3fc8051ee061e31db13e2fe011e8e0b71a7f815"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c4f73104016748533a5707ecd15930fbeff402"
        },
        {
          "url": "https://git.kernel.org/stable/c/91784f3d77b73885e1b2e6b59d3cbf0de0a1126a"
        },
        {
          "url": "https://git.kernel.org/stable/c/11270e7ca268e8d61b5d9e5c3a54bd1550642c9c"
        }
      ],
      "title": "xprtrdma: treat all calls not a bcall when bc_serv is NULL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49321",
    "datePublished": "2025-02-26T02:10:46.186Z",
    "dateReserved": "2025-02-26T02:08:31.537Z",
    "dateUpdated": "2026-08-05T08:54:42.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49321",
      "date": "2026-08-05",
      "epss": "0.00761",
      "percentile": "0.51813"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49321\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:08.933\",\"lastModified\":\"2026-08-04T10:17:43.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxprtrdma: treat all calls not a bcall when bc_serv is NULL\\n\\nWhen a rdma server returns a fault format reply, nfs v3 client may\\ntreats it as a bcall when bc service is not exist.\\n\\nThe debug message at rpcrdma_bc_receive_call are,\\n\\n[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID\\n00000001, length=20\\n[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00\\n00 00 00 00 00 00 00 00 00 00 00 00 04\\n\\nAfter that, rpcrdma_bc_receive_call will meets NULL pointer as,\\n\\n[  226.057890] BUG: unable to handle kernel NULL pointer dereference at\\n00000000000000c8\\n...\\n[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20\\n...\\n[  226.059732] Call Trace:\\n[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]\\n[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]\\n[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]\\n[  226.060257]  process_one_work+0x1a7/0x360\\n[  226.060367]  ? create_worker+0x1a0/0x1a0\\n[  226.060440]  worker_thread+0x30/0x390\\n[  226.060500]  ? create_worker+0x1a0/0x1a0\\n[  226.060574]  kthread+0x116/0x130\\n[  226.060661]  ? kthread_flush_work_fn+0x10/0x10\\n[  226.060724]  ret_from_fork+0x35/0x40\\n...\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xprtrdma: trata todas las llamadas como no bcall cuando bc_serv es NULL Cuando un servidor rdma devuelve una respuesta en formato de error, el cliente nfs v3 puede tratarla como una bcall cuando el servicio bc no existe. El mensaje de depuraci\u00f3n en rpcrdma_bc_receive_call es, [56579.837169] RPC: rpcrdma_bc_receive_call: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdma_bc_receive_call: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 Despu\u00e9s de eso, rpcrdma_bc_receive_call encontrar\u00e1 un puntero NULL como, [ 226.057890] ERROR: no se puede manejar la desreferencia del puntero NULL del kernel en 00000000000000c8 ... [ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878] rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] [ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] [ 226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] [ 226.060257] process_one_work+0x1a7/0x360 [ 226.060367] ? create_worker+0x1a0/0x1a0 [ 226.060440] worker_thread+0x30/0x390 [ 226.060500] ? create_worker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10 [ 226.060724] ret_from_fork+0x35/0x40 ...\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xprtrdma/rpc_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"8e3943c50764dc7c5f25911970c3ff062ec1f18c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"998d35a2aff4b81a1c784f3aa45cd3afff6814c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"da99331fa62131a38a0947a8204c5208de7b0454\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"8dbae5affbdbf524b48000f9d357925bb001e5f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"a3fc8051ee061e31db13e2fe011e8e0b71a7f815\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"90c4f73104016748533a5707ecd15930fbeff402\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"91784f3d77b73885e1b2e6b59d3cbf0de0a1126a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63cae47005af51c937f4cdcc4835f29075add2ba\",\"lessThan\":\"11270e7ca268e8d61b5d9e5c3a54bd1550642c9c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xprtrdma/rpc_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.283\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.247\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.198\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.122\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.47\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.15\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.4\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:43:44.893562Z\",\"id\":\"CVE-2022-49321\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.283\",\"matchCriteriaId\":\"42074657-A7B6-4740-88B7-67B440018C1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.247\",\"matchCriteriaId\":\"B8CFA0F4-2D75-41F4-9753-87944A08B53B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.198\",\"matchCriteriaId\":\"3EC49633-14DE-4EBD-BB80-76AE2E3EABB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.122\",\"matchCriteriaId\":\"1B42AA01-44D8-4572-95E6-FF8E374CF9C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.47\",\"matchCriteriaId\":\"FC042EE3-4864-4325-BE0B-4BCDBF11AA61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.15\",\"matchCriteriaId\":\"53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.4\",\"matchCriteriaId\":\"FA6D643C-6D6A-4821-8A8D-B5776B8F0103\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11270e7ca268e8d61b5d9e5c3a54bd1550642c9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8dbae5affbdbf524b48000f9d357925bb001e5f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e3943c50764dc7c5f25911970c3ff062ec1f18c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90c4f73104016748533a5707ecd15930fbeff402\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91784f3d77b73885e1b2e6b59d3cbf0de0a1126a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/998d35a2aff4b81a1c784f3aa45cd3afff6814c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a3fc8051ee061e31db13e2fe011e8e0b71a7f815\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da99331fa62131a38a0947a8204c5208de7b0454\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:43:15+00:00",
      "cve": "CVE-2022-49321",
      "id": "CVE-2022-49321",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xprtrdma: treat all calls not a bcall when bc_serv is NULL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49321.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:14:23Z",
      "cve": "CVE-2022-49321",
      "id": "CVE-2022-49321",
      "initial_release_date": "2025-02-27T03:08:46Z",
      "product_status:known_affected": "365",
      "product_status:known_not_affected": "209",
      "product_status:recommended": "348",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49321",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49321.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49321\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:43:44.893562Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:15:01.390Z\"}}], \"cna\": {\"title\": \"xprtrdma: treat all calls not a bcall when bc_serv is NULL\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"8e3943c50764dc7c5f25911970c3ff062ec1f18c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"998d35a2aff4b81a1c784f3aa45cd3afff6814c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"da99331fa62131a38a0947a8204c5208de7b0454\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"8dbae5affbdbf524b48000f9d357925bb001e5f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"a3fc8051ee061e31db13e2fe011e8e0b71a7f815\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"90c4f73104016748533a5707ecd15930fbeff402\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"91784f3d77b73885e1b2e6b59d3cbf0de0a1126a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63cae47005af51c937f4cdcc4835f29075add2ba\", \"lessThan\": \"11270e7ca268e8d61b5d9e5c3a54bd1550642c9c\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sunrpc/xprtrdma/rpc_rdma.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.247\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.47\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sunrpc/xprtrdma/rpc_rdma.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8e3943c50764dc7c5f25911970c3ff062ec1f18c\"}, {\"url\": \"https://git.kernel.org/stable/c/998d35a2aff4b81a1c784f3aa45cd3afff6814c1\"}, {\"url\": \"https://git.kernel.org/stable/c/da99331fa62131a38a0947a8204c5208de7b0454\"}, {\"url\": \"https://git.kernel.org/stable/c/8dbae5affbdbf524b48000f9d357925bb001e5f4\"}, {\"url\": \"https://git.kernel.org/stable/c/a3fc8051ee061e31db13e2fe011e8e0b71a7f815\"}, {\"url\": \"https://git.kernel.org/stable/c/90c4f73104016748533a5707ecd15930fbeff402\"}, {\"url\": \"https://git.kernel.org/stable/c/91784f3d77b73885e1b2e6b59d3cbf0de0a1126a\"}, {\"url\": \"https://git.kernel.org/stable/c/11270e7ca268e8d61b5d9e5c3a54bd1550642c9c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxprtrdma: treat all calls not a bcall when bc_serv is NULL\\n\\nWhen a rdma server returns a fault format reply, nfs v3 client may\\ntreats it as a bcall when bc service is not exist.\\n\\nThe debug message at rpcrdma_bc_receive_call are,\\n\\n[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID\\n00000001, length=20\\n[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00\\n00 00 00 00 00 00 00 00 00 00 00 00 04\\n\\nAfter that, rpcrdma_bc_receive_call will meets NULL pointer as,\\n\\n[  226.057890] BUG: unable to handle kernel NULL pointer dereference at\\n00000000000000c8\\n...\\n[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20\\n...\\n[  226.059732] Call Trace:\\n[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]\\n[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]\\n[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]\\n[  226.060257]  process_one_work+0x1a7/0x360\\n[  226.060367]  ? create_worker+0x1a0/0x1a0\\n[  226.060440]  worker_thread+0x30/0x390\\n[  226.060500]  ? create_worker+0x1a0/0x1a0\\n[  226.060574]  kthread+0x116/0x130\\n[  226.060661]  ? kthread_flush_work_fn+0x10/0x10\\n[  226.060724]  ret_from_fork+0x35/0x40\\n...\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.283\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.247\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.198\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.122\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.47\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.15\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.4\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"4.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:57:26.194Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49321\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:57:26.194Z\", \"dateReserved\": \"2025-02-26T02:08:31.537Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:10:46.186Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.