The Linux kernel NFSD subsystem contains a flaw in dentry handling that can be exploited by unauthenticated remote attackers to cause a system crash.

This is a NULL pointer dereference vulnerability occurring in the nfsd_mode_check function. An unauthenticated attacker can trigger this flaw during an NFS reexport operation by providing a dentry that lacks a lookup method, ultimately leading to a kernel panic.

The vulnerability carries a CVSS score of 8.2, reflecting a high risk of service disruption. Successful exploitation results in a kernel panic, leading to immediate system downtime and potential data loss for users of the NFS service. Because the flaw is reachable by unauthenticated remote attackers, it poses a significant threat to the availability of storage infrastructure.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel panic events or repeated NFS service failures that may indicate exploitation attempts.

Compensating Controls: Restrict access to the NFS service to trusted network segments using firewall rules to minimize the attack surface until patches can be deployed.

Public Exploit Available: Unknown

Given the high CVSS score and the critical nature of the NFS service, organizations should prioritize patching affected kernel versions. Administrators must verify their current kernel build and apply the latest stable security updates from their distribution vendor to eliminate the risk of remote denial of service.