The flaw originates from a dead code path in nfsd4_create that drops ACL pointers without freeing the original objects, leading to a memory leak of posix_acl structures with each request. When an attacker sends creation requests that include both ACL attributes, the leaked kernel objects accumulate and can exhaust slab memory, eventually triggering a Denial of Service. This vulnerability is a classic resource exhaustion weakness identified as CWE-772.

The issue is present in all Linux kernels that contain the nfsd4_create implementation and run an NFSv4 server before the patch commit. Versions of the kernel prior to the inclusion of commit 8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e are affected. Backport versions and newer stable releases that incorporate this commit are not vulnerable. Administrators should verify their kernel version and ensure the use of a patched release.

A CVSS score of 7.5 highlights the severity, but an EPSS score of less than 1% and the absence from the CISA KEV list suggest exploitation is unlikely at present. The vulnerability requires network access to the NFS service and the ability to craft CREATE requests with both ACL attributes, so exposure through publicly accessible NFS servers elevates the threat. The practical risk is therefore moderate for exposed services, but the exploitation probability remains low.