In the Linux kernel’s VFS, the NFS server routine nfsd4_create_file must release a parent directory lock with end_creating(). When file creation is performed through atomic_create() and that call fails, nfsd4_create_file receives an error pointer and passes it to end_creating(), which then fails to unlock the parent. The mis‑ordered unlock logic leads to a parent lock that remains held, preventing any further write or creation operations in that directory until the lock is forced released or the system is restarted. The flaw is a classic resource‑leak bug (CWE‑773) caused by improper lock handling (CWE‑547).

Any Linux kernel running the unpatched VFS code is affected, and specifically NFS servers that export filesystems and call atomic_create() during file creation. The bug is present in all kernel versions before the patch commit referenced in the advisory; therefore systems with older or unpatched kernels exposing NFS shares using the atomic_create API are potentially impacted.

The advisory does not provide a CVSS score or an EPSS probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation yet. However, the error‑induced lock leak can be triggered by sending malformed or large create requests over the network to an exposed NFS server. Once triggered, the lock will remain held, effectively denying all clients write access to that directory and causing a denial of service. The risk is moderate, but the impact on service availability warrants immediate attention.