The Linux kernel’s NFSv4 server contains two defects in the nfsd4_create_file routine. First, when a client requests an ACL that the kernel cannot translate to a POSIX ACL, the failure from nfsd4_acl_to_attr() is silently discarded and the server creates the file without any ACL, violating RFC 7530/8881 and allowing unintended access. Second, on certain error paths the kernel allocates a posix_acl structure but never frees it; a client can trigger this repeatedly by issuing CREATE requests with unsupported ACL entries or overly long filenames, leading to a memory leak that can exhaust kernel memory over time. Together, these flaws result in improper access control and the potential for denial‑of‑service through resource exhaustion.

All Linux distributions that ship a Linux kernel with an active NFSv4 server are potentially affected. The issue is present in any kernel that implements nfsd4_create_file; no specific release is singled out in the advisory, so any deployment of the Linux kernel that processes NFSv4 CREATE requests may be vulnerable.

The vulnerability has a CVSS score of 7.1 and an EPSS score below 1 %, indicating a relatively low probability of exploitation but still worth addressing promptly. It is not listed in CISA KEV. A remote NFSv4 client can trigger the flaw simply by issuing specially crafted CREATE operations containing unsupported ACL entries or excessively long filenames. The attack does not require elevated privileges on the server; any network path to the NFSv4 service can be used. Successful exploitation results in files created without the intended ACL and, if repeated, drains kernel memory and may degrade performance or cause a service outage.