{"id":"CVE-2022-48828","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix ia_size underflow\n\niattr::ia_size is a loff_t, which is a signed 64-bit type","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix ia_size underflow\n\niattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and\nNFSv4 both define file size as an unsigned 64-bit type. Thus there\nis …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-191"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel < 5.4.295","linux_kernel >= 5.5, < 5.10.220","linux_kernel >= 5.11, < 5.15.24","linux_kernel >= 5.16, < 5.16.10","linux_kernel = 5.17"],"patched":["linux_kernel 5.16.10"],"published":"2024-07-16","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:16:57.047","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-48828","references":[{"url":"https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00631,"epssPercentile":0.50044,"ingestedAt":"2026-10-14T19:49:57.532Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T16:57:36.884780Z"},"slug":"CVE-2022-48828","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix ia_size underflow\n\niattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and\nNFSv4 both define file size as an unsigned 64-bit type. Thus there\nis a range of valid file size values an NFS client can send that is\nalready larger than Linux can handle.\n\nCurrently decode_fattr4() dumps a full u64 value into ia_size. If\nthat value happens to be larger than S64_MAX, then ia_size\nunderflows. I'm about to fix up the NFSv3 behavior as well, so let's\ncatch the underflow in the common code path: nfsd_setattr().\n\n## Affected\n\n- `linux_kernel < 5.4.295`\n- `linux_kernel >= 5.5, < 5.10.220`\n- `linux_kernel >= 5.11, < 5.15.24`\n- `linux_kernel >= 5.16, < 5.16.10`\n- `linux_kernel = 5.17`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.16.10`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}