CVE-2022-24448: Debian Linux

Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Linux Linux Kernel: before 5.16.5 (fixed in 5.16.5)

Published 2022-02-04. Last modified 2026-06-17.