The Linux kernel contains a heap overflow in the NFSv4.0 replay cache. A fixed 112-byte buffer is used to store encoded operation responses, but when a LOCK operation is denied and the response contains a large lock owner string, the kernel copies the entire response into this buffer without performing a bounds check. This results in a slab‑out‑of‑bounds write that can corrupt adjacent heap memory, potentially compromising kernel stability and data integrity.

The flaw affects Linux kernel builds that include the NFSv4.0 server and employ the replay cache logic. Any Linux system running a kernel version prior to the applied fix, and exposing an NFSv4.0 service, is potentially vulnerable; specific version numbers are not enumerated in the available data.

The CVSS score of 9.8 indicates a critical severity risk. The EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. The attack can be initiated remotely by an unauthenticated attacker using two cooperating NFSv4.0 clients: one client sets a lock with a large owner string and the second client requests a conflicting lock to trigger the denial and overflow.