Executive brief
The Linux kernel's NFS server (nfsd) component contains a memory leak when processing malformed NFS OPEN requests with POSIX ACL attributes. An attacker can repeatedly trigger this leak by sending crafted NFS requests, eventually exhausting server memory and causing service disruption or denial of service. This affects systems running vulnerable Linux kernels that expose NFS services.
Technical details
The vulnerability is a resource leak (CWE-401) in nfsd4_decode_open_claim4() within the Linux kernel's NFS server implementation. When the function returns a non-seqid-mutating error, the OPEN dispatcher short-circuits before the main operation handler (nfsd4_open) executes, bypassing the normal cleanup code that releases POSIX ACL objects allocated during open processing. Additionally, the op_release callback was not invoked on the replay path for NFS v4.0 replayed operations, causing further leaks. A network attacker can trigger this by sending malformed OPEN compounds with valid POSIX ACL attributes, leaking kernel memory on each request with no authentication required.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-11: disclosed