A critical null pointer dereference vulnerability in the Linux kernel nfsd subsystem allows unauthenticated remote attackers to cause a denial of service through a kernel crash.

The vulnerability exists in the nfsd4_setattr function, where the kernel fails to validate the stateid pointer when processing delegation timestamp attributes. An unauthenticated attacker can send a malicious NFSv4 COMPOUND request containing a special stateid, resulting in a null pointer dereference and a subsequent kernel oops.

The primary risk associated with this vulnerability is a complete denial of service for the affected NFS server. Because the flaw allows an unauthenticated remote attacker to trigger a kernel panic, it can be used to disrupt critical file storage services, leading to system instability and potential downtime for any applications relying on the impacted NFS shares. While the CVSS score of 7.5 reflects the high impact on availability, the lack of required authentication makes this a significant concern for exposed infrastructure.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for repeated kernel oops messages or sudden NFS service restarts that may indicate attempted exploitation.

Compensating Controls: Restrict access to NFS services at the network level using firewalls or VPNs to ensure only trusted clients can interact with the nfsd service.

Public Exploit Available: No

Given the ease of exploitability and the potential for complete system disruption, administrators should prioritize patching the Linux kernel across all affected environments. Organizations utilizing NFSv4 for critical storage must treat this as a high-priority update to prevent unauthorized service interruption. If immediate patching is not feasible, network segmentation remains the most effective defense against remote exploitation.