An access control list handling vulnerability in the Linux kernel NFS subsystem allows authenticated attackers to cause a denial of service and bypass security constraints.

This is an improper error handling and resource management flaw located in the nfsd4_create_file function within the NFS daemon, requiring low privileges and network access for exploitation.

A successful exploit against the Linux kernel NFS daemon can lead to memory exhaustion and subsequent denial of service conditions, impacting overall system stability and resource availability for valid network users. Furthermore, the improper handling of access control lists violates protocol specifications, potentially leading to unintended file creation behavior. With a CVSS score of 7.1, this high severity vulnerability poses a significant risk to enterprise infrastructure relying heavily on network file sharing services.

Immediate Action: Update the Linux kernel to version 7.1.3 or apply the corresponding stable fix commits 18cf006a08babec0bbac2a3784f8f28e56e47490 and 24c975bbdd564d7d0ad90294bfa69729830345de.

Proactive Monitoring: Monitor system logs for unusual kernel memory consumption patterns, resource allocation errors, or repeated failed NFS create operations that could indicate malicious probing.

Compensating Controls: Restrict network access to the NFS daemon using firewall rules or security groups, limiting exposure to trusted internal networks only.

Public Exploit Available: No

Security teams managing Linux kernel deployments must treat this high severity vulnerability with urgency due to the potential for denial of service. Administrators should apply the official kernel updates immediately to mitigate resource leak risks and ensure compliance with NFS protocol security standards.