Executive brief
The NFSD (NFS server daemon) component in the Linux kernel inadvertently sends uninitialized memory contents in NFSv2 GETACL responses due to an incomplete code migration. This leaks stale kernel memory onto the network, exposing potentially sensitive information that could be captured by network monitoring or analysis.
Technical details
The vulnerability stems from incomplete xdr_stream conversion in the NFSv2 GETACL result encoder (fs/nfsd/nfs2acl.c). Legacy code that set the response buffer's page_len field was left in place after the encoder was refactored to use xdr_stream, which handles buffer management automatically. This results in garbage (uninitialized kernel memory) being appended past the end of valid reply messages. An NFS client making GETACL requests to an affected server will receive extra data containing stale memory contents. The vulnerability is triggered by normal NFSv2 GETACL operations and requires network access to the NFS server; no authentication bypass or privilege escalation is involved, but the information leak could expose kernel secrets or sensitive data.
Affected products
- Linux Linux kernel Multiple versions (affected code present in numerous stable branches)
Timeline
- 2025-12-30: disclosed: Published on NVD
- 2022-12-31: patched: Fix committed to stable trees (e.g., commit 2b825efb0577a32a872e872a869e0947cf9dd6d3)