A vulnerability in the Linux kernel NFS daemon could allow a local authenticated attacker to trigger out-of-bounds memory reads, potentially leading to information disclosure or system instability.

The vulnerability exists in the nfsd_dispatch function, which fails to correctly reset the rq_status_counter to an even value during specific exit paths. An attacker with local, low-privileged access can exploit this state to deceive a lockless reader, causing it to access memory outside the bounds of the expected array.

The flaw carries a CVSS score of 7.1, reflecting a significant risk to confidentiality and system availability. Successful exploitation could allow a local attacker to leak sensitive kernel memory or cause the system to crash, resulting in service disruption. While the attack requires local access, the potential for kernel-level memory corruption makes this a high-priority concern for environments relying on NFS for critical data operations.

Immediate Action: Administrators should update the Linux kernel to version 7.2.4 or later, or apply the relevant patches provided by the upstream Linux stable repository.

Proactive Monitoring: Security teams should monitor system logs for recurring nfsd crashes or kernel panic events that may indicate exploitation attempts.

Compensating Controls: Ensure that access to the local system is restricted to trusted users, as this vulnerability requires local privileges to trigger the race condition.

Public Exploit Available: Unknown

Given the severity of potential memory corruption within the kernel, organizations should prioritize testing and deploying the provided kernel patches. Immediate remediation is necessary to prevent local users from escalating their impact or causing denial-of-service conditions through this race condition.