A memory leak vulnerability in the Linux kernel NFS implementation poses a denial of service risk to systems processing malformed network requests.

The Linux kernel nfsd component fails to properly release POSIX ACL objects when an OPEN compound request encounters a non-seqid-mutating error. This unauthenticated flaw allows an attacker to leak memory resources on every malformed request, eventually leading to service exhaustion.

The vulnerability carries a CVSS score of 7.5, reflecting its potential to cause significant service instability. An attacker can remotely trigger this memory leak without authentication, leading to a denial of service for critical storage services. This could result in prolonged system downtime and operational disruption for environments relying on NFS for file sharing.

Immediate Action: Administrators should update the Linux kernel to version 7.2.4 or later, where the memory release mechanism for OP_OPEN has been corrected.

Proactive Monitoring: Monitor system memory usage and kernel logs for signs of resource exhaustion or instability following the receipt of unexpected NFS traffic.

Compensating Controls: If immediate patching is not feasible, restrict access to the NFS service to trusted network segments to reduce the attack surface.

Public Exploit Available: No

Given the potential for remote denial of service, organizations should prioritize updating their Linux kernels to the fixed version. The ability to trigger this vulnerability without authentication increases the urgency, as it does not require prior access to the network or valid user credentials.