The flaw lies in the Linux kernel’s NFSv4.0 replay cache that stores encoded operation responses in a 112‑byte inline buffer. For LOCK operations that are denied due to a conflict, the lock owner field can be up to 1,024 bytes, causing the encoded response to exceed the buffer size. As the kernel copies the response without bounds checking, the overwrite propagates up to 944 bytes beyond the buffer, corrupting adjacent heap memory. This type of memory corruption can lead to a crash or, if the heap is manipulated correctly, arbitrary code execution on the NFS server.

All Linux kernels that include the nfsd component for NFSv4.0 servers are affected, regardless of distribution, because the vulnerable code path is part of the core kernel NFS implementation. Any system running a kernel that has not applied the fix will be vulnerable.

The vulnerability permits remote exploitation without authentication, requiring only two NFS clients to coordinate conflicting lock operations. The absence of bounds checks makes the overflow straightforward to trigger, and the overflow can reach almost a kilobyte of heap corruption. While the CVSS score and EPSS are not provided, the potential impact is significant; the flaw is not listed in the CISA KEV catalog, yet it remains a high‑risk issue that could be used to disrupt service or compromise the server if an attacker can exploit the heap corruption.