An unconfirmed retry race condition in the Linux kernel nfsd component allows remote attackers to cause a denial of service via memory exhaustion.

This is a memory leak vulnerability (CWE-401) stemming from improper handling of pre-allocated open stateowners during concurrent NFSv4.0 OPEN operations. The attacker requires no privileges and no user interaction, utilizing the network vector to trigger the race condition.

A successful exploit allows an unauthenticated remote adversary to continuously leak kernel memory by repeatedly triggering the openowner race condition. This leads to system instability, resource exhaustion, and potential host crashes, disrupting critical file storage services. The assigned CVSS score of 7.5 reflects the high impact on system availability despite the complexity of timing the race window.

Immediate Action: Update the Linux kernel to version 6.12.95, 6.18.38, 7.1.3, or later depending on the active branch, applying the upstream fix commit c9aefb2b5f11337c9202c5bd0c45d71198449718.

Proactive Monitoring: Monitor kernel memory utilization metrics and kernel log files for signs of rapid slab allocator consumption or abnormal nfsd thread behavior.

Compensating Controls: Restrict network access to the NFS service using host-based firewalls or network segmentation to limit exposure to trusted clients only.

Public Exploit Available: false

Given the high severity score and potential for denial of service against storage infrastructure, administrators should prioritize updating affected Linux kernels to the latest patched releases. Apply network-level restrictions immediately if patching must be scheduled during a maintenance window.