Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a remote user to cause a system slowdown or crash. By sending specifically crafted file creation requests, an attacker can trigger a memory leak that gradually consumes all available system memory. This can lead to a denial-of-service condition, impacting the availability of the server and any hosted applications.
Technical details
A vulnerability exists in nfsd4_create() within the Linux kernel's NFS server implementation due to a logic error in how Access Control List (ACL) attributes are handled. The function 'steals' ACL pointers into a local structure and nullifies the source pointers before performing a conflict check. This results in a 'dead code' condition where the check always fails to detect conflicting ACL types. When a client sends a CREATE request containing both FATTR4_WORD0_ACL and POSIX ACL attributes, nfsd4_acl_to_attr() overwrites existing pointers without releasing them, leading to a leak of posix_acl slab objects. An attacker can exploit this via repeated network requests to cause unbounded slab exhaustion and a denial-of-service. The issue is fixed by correctly checking the transferred attribute values.
Affected products
- Linux Linux Kernel 7.0 to 7.1.3
Timeline
- 2026-05-21: other: Vulnerability fixed in upstream source code
- 2026-07-19: disclosed: CVE published to NVD