An unauthenticated remote attacker can trigger a denial of service condition in the Linux kernel NFS implementation by sending a crafted request that forces excessive CPU consumption.

This is an algorithmic complexity vulnerability (CWE-407) in the nfsd4_decode_posixacl function. The kernel fails to properly cap the POSIX ACL entry count during XDR decoding, allowing an unauthenticated attacker to pass a large count that triggers an O(n^2) bubble sort operation, leading to resource exhaustion.

Successful exploitation results in a denial of service for the affected NFS server, as the kernel becomes unresponsive while processing the malicious sort operation. This impacts business continuity by disrupting file access services and potentially crashing the underlying system. With a CVSS score of 7.5, this represents a significant availability risk for infrastructure relying on network-attached storage.

Immediate Action: Update the Linux kernel to version 7.2.4 or later, or apply the upstream fix commits provided by the Linux stable maintainers.

Proactive Monitoring: Monitor NFS server CPU utilization and kernel logs for performance degradation or errors related to nfsd processing.

Compensating Controls: If patching is not immediately feasible, restrict network access to the NFS service to trusted internal IP addresses using host-based firewalls or network access control lists to prevent unauthenticated access.

Public Exploit Available: Unknown

Given the potential for remote denial of service, administrators of Linux systems providing NFS services should prioritize the application of the kernel patch. While there is no current evidence of active exploitation, the accessibility of the vulnerable endpoint makes this a high-priority update to ensure system availability and stability.