The flaw originates from a dead code path in nfsd4_create that drops ACL pointers without freeing the original objects, leading to a memory leak of posix_acl structures with each request. When an attacker sends creation requests that include both ACL attributes, the leaked kernel objects accumulate and can exhaust slab memory, eventually triggering a Denial of Service. This vulnerability is a classic resource exhaustion weakness identified as CWE-674 and CWE-772.

The issue is present in all Linux kernels that contain the nfsd4_create implementation and run an NFSv4 server before the patch commit. Versions of the kernel prior to the inclusion of commit 8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e are affected. Backport versions and newer stable releases that incorporate this commit are not vulnerable. Administrators should verify their kernel version and ensure the use of a patched release.

A CVSS score of 7.5 highlights the severity, but an EPSS score of less than 1% and the absence from the CISA KEV list suggest exploitation is unlikely at present. Based on the description, it is inferred that the most likely attack vector involves network traffic to a running NFSv4 server, where a malicious client can craft CREATE requests that include both ACL attributes, thereby exposing the service to denial‑of‑service. The practical risk for systems with publicly accessible NFS servers is therefore moderate, but the overall exploitation probability remains low.