A memory management flaw in the Linux kernel NFSv4.2 client can lead to system-wide denial of service through buffer exhaustion.

This vulnerability is a buffer overflow and resource exhaustion flaw occurring within the NFSv4.2 layout statistics encoding process. An unauthenticated remote server can provide specially crafted filehandles or addresses that cause the kernel to exceed its allocated send buffer, resulting in a null pointer dereference or a permanent kernel lockup due to improperly managed spinlocks.

The primary impact of this vulnerability is a severe denial of service, as a compromised or malicious NFS server can cause a kernel panic or persistent system hang on connected clients. Given the critical role of the Linux kernel in infrastructure, such failures lead to significant operational downtime, service unavailability, and potential data corruption during unexpected system terminations. The CVSS score of 7.5 reflects the high potential for service disruption despite the absence of direct remote code execution.

Immediate Action: Update the Linux kernel to the versions identified in the OSV fix data (5.10.270, 5.15.221, 6.1.188, 6.6.157, or later) as soon as possible.

Proactive Monitoring: Monitor system logs for kernel oops, stack traces related to NFS, or unexpected system reboots that may indicate a triggered lockup condition.

Compensating Controls: Restrict NFS mounting to trusted, authenticated, and known-secure server endpoints to prevent interaction with malicious or untrusted NFS servers.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to the stability of any Linux-based environment utilizing NFSv4.2. Organizations should prioritize patching their kernel builds to the recommended stable versions to eliminate the possibility of server-induced system lockups. If an immediate kernel update is not feasible, ensure that all NFS server connections are restricted to trusted internal infrastructure to mitigate the attack surface.