# CVE-2022-43945: Linux Kernel NFSD buffer overflow in RPC handling

Source: https://junglewise.ai/threats/cve-2022-43945-linux-kernel-nfsd-buffer-overflow-in-rpc-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-04. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2022-43945 · Severity: high · CVSS 7.5 · Published 2022-11-04

A vulnerability exists in the Linux kernel's Network File System (NFS) server component, which is used to share files across a network. An attacker can send a specially crafted network message to crash the server, leading to a denial-of-service condition. This could disrupt business operations by making shared files and storage systems unavailable to users and applications.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [NetApp H300s Firmware](https://junglewise.ai/threats/technologies/h300s-firmware), [NetApp H410c Firmware](https://junglewise.ai/threats/technologies/h410c-firmware), [NetApp H410s Firmware](https://junglewise.ai/threats/technologies/h410s-firmware), [NetApp H500s Firmware](https://junglewise.ai/threats/technologies/h500s-firmware), [NetApp H700s Firmware](https://junglewise.ai/threats/technologies/h700s-firmware), [Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp-gnu-linux-subsystem). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [NetApp](https://junglewise.ai/threats/vendors/netapp), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2022-43945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-43945 being exploited in the wild.

**How severe is CVE-2022-43945?** High severity, with a CVSS score of 7.5, published 4 November 2022.

**Which products and versions are affected?** Linux Kernel versions before 5.19.17, versions 6.0.x before 6.0.2.

**Is there a fix for CVE-2022-43945?** A patch was published on 2022-10-03: Fix committed to Linux kernel source Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-43945 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2022-43945?** Check whether you run Linux Kernel, NetApp Active IQ Unified Manager for VMware vSphere, NetApp H300s Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the Linux kernel NFSD (NFS server) implementation due to incorrect calculation of buffer sizes when handling Remote Procedure Call (RPC) messages. NFSD shares receive and send buffers in a single array of pages; an attacker can send a specially crafted RPC message over TCP with trailing 'garbage' data that is technically compliant with the specification but causes the send buffer to shrink unexpectedly. When the server attempts to construct a reply, it writes beyond the allocated page boundaries because it assumes a full-sized buffer is available. This can be triggered remotely without authentication (depending on export configuration) and results in a kernel panic or denial of service. The issue was addressed in Linux kernel versions 5.19.17 and 6.0.2.

## Affected products

- Linux Linux Kernel versions before 5.19.17, versions 6.0.x before 6.0.2
- NetApp H300S Firmware
- NetApp H410C Firmware
- NetApp H410S Firmware
- NetApp H500S Firmware
- NetApp H700S Firmware
- NetApp Active IQ Unified Manager for VMware vSphere
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

## Timeline

- 2022-10-03: patched: Fix committed to Linux kernel source
- 2022-11-04: disclosed: Initial NVD publication
- 2022-12-15: advisory: NetApp advisory published
- 2024-04-09: advisory: Siemens advisory published

## References

- [http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html](http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html)
- [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f90497a16e434c2211c66e3de8e77b17868382b8](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f90497a16e434c2211c66e3de8e77b17868382b8)
- [https://security.netapp.com/advisory/ntap-20221215-0006/](https://security.netapp.com/advisory/ntap-20221215-0006/)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)