CVE-2022-47940: linux linux_kernel Out-of-bounds Read
Vulnerability summary
CVE-2022-47940 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in linux linux_kernel. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 75% of scored vulnerabilities.
Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 23-12-2022PublishedVulnerability first disclosed.
- 14-04-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
1.54%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 1.46% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu66 products
- linux< 5.15.0-60.66
- linux-aws< 5.15.0-1030.34
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Debian1 product
- linux< 5.19.6-1
Linux1 product
- linux_kernel≥ 5.15, < 5.15.145 | ≥ 5.16, < 5.18.18
3 vendors · 68 products
