CVE-2022-50460: cifs: Fix xid leak in cifs_flock()

Q: What is the severity of CVE-2022-50460?

CVE-2022-50460 is considered a moderate severity vulnerability due to its potential impact on resource management in the Linux kernel.

Q: What does CVE-2022-50460 affect?

CVE-2022-50460 affects the Linux kernel, specifically the CIFS (Common Internet File System) implementation.

Q: How do I fix CVE-2022-50460?

To fix CVE-2022-50460, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.

Q: What is the nature of the issue in CVE-2022-50460?

CVE-2022-50460 involves an xid leak occurring in the cifs_flock() function when returning -ENOLCK without freeing the xid.

Q: Is CVE-2022-50460 exploitable in the wild?

There have been no confirmed reports of exploitation of CVE-2022-50460 in the wild as of now.

Published Oct 1, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix xid leak in cifsflock()

If not flock, before return -ENOLCK, should free the xid, otherwise, the xid will be leaked.

Affected Software

123 affected componentsFixes available

Linux Kernel

Linux Linux kernel>=5.5<5.10.152

Linux Linux kernel>=5.11<5.15.76

Linux Linux kernel>=5.16<6.0.6

Linux Linux kernel=6.1-rc1

debian/linux<6.0.6-1

6.0.6-1

debian/linux<6.0.6-1

6.0.6-1

debian/linux<6.0.6-1

6.0.6-1

linux/kernel>=5.5.0<5.10.152

5.10.152

linux/kernel>=5.11.0<5.15.76

5.15.76

linux/kernel>=5.16.0<6.0.6

6.0.6

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.15-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1030.34~20.04.1

5.15.0-1030.34~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1033.40~20.04.1

5.15.0-1033.40~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1029.36~20.04.1

5.15.0-1029.36~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-60.66~20.04.1

5.15.0-60.66~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1025.30~20.04.1

5.15.0-1025.30~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-60.66~20.04.1

5.15.0-60.66~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1029.35~20.04.1

5.15.0-1029.35~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1029.33~20.04.1

5.15.0-1029.33~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-60.66

5.15.0-60.66

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1030.34

5.15.0-1030.34

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1033.40

5.15.0-1033.40

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde<5.15.0-1033.40.1

5.15.0-1033.40.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1029.36

5.15.0-1029.36

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1027.32

5.15.0-1027.32

ubuntu/linux-gkeop<5.15.0-1015.19

5.15.0-1015.19

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1025.28

5.15.0-1025.28

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1025.30

5.15.0-1025.30

ubuntu/linux-kvm<5.15.0-1028.33

5.15.0-1028.33

ubuntu/linux-lowlatency<5.15.0-60.66

5.15.0-60.66

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1017.17

5.15.0-1017.17

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1029.35

5.15.0-1029.35

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1024.26

5.15.0-1024.26

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-bluefield<5.15.0-1014.16

5.15.0-1014.16

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-intel*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.8*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.36~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.30~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.35~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.33~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.36
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.32
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.19
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.28
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.30
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1028.33
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.35
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1024.26
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.16
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.0.6-1
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 5.10.152
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 5.15.76
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.0.6
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1

Event History

Oct 1, 2025

CVE Published

via MITRE·11:45 AM

Data Sourced

via MITRE·11:45 AM

Description

Data Sourced

via OSV·11:45 AM

DescriptionAffected Software

Data Sourced

via NVD·12:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Nov 11, 2026

Data Sourced

via OSV·09:37 AM

Severity

Frequently Asked Questions

What is the severity of CVE-2022-50460?

CVE-2022-50460 is considered a moderate severity vulnerability due to its potential impact on resource management in the Linux kernel.

What does CVE-2022-50460 affect?

CVE-2022-50460 affects the Linux kernel, specifically the CIFS (Common Internet File System) implementation.

How do I fix CVE-2022-50460?

To fix CVE-2022-50460, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.

What is the nature of the issue in CVE-2022-50460?

CVE-2022-50460 involves an xid leak occurring in the cifs_flock() function when returning -ENOLCK without freeing the xid.

Is CVE-2022-50460 exploitable in the wild?

There have been no confirmed reports of exploitation of CVE-2022-50460 in the wild as of now.

CVE-2022-50460: cifs: Fix xid leak in cifs_flock()

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2022-50460?

What does CVE-2022-50460 affect?

How do I fix CVE-2022-50460?

What is the nature of the issue in CVE-2022-50460?

Is CVE-2022-50460 exploitable in the wild?

Company

Resources

Contact