The vulnerability in the Linux kernel’s lockd NFS lock manager causes a memory leak when the nlm_do_fopen() function fails. The bug causes code to release the nlm_file_mutex and return without freeing an allocated nlm_file object. Repeated failures can therefore accumulate a large number of unreleased nlm_file structures, gradually exhausting kernel memory and potentially leading to a denial of service.

The affected product is the Linux kernel provided by the Linux vendor. Clients that use NFS lockd on a kernel containing this unpatched code are susceptible. Specific kernel version identifiers are not supplied in the data, so any release that includes the buggy code path is at risk, especially those before the commit that routes failures to a memory‑free path.

The CVSS score for this issue is 7.0, but the nature of the flaw – a memory leak that can be repeatedly triggered – indicates potential for significant impact by exhausting system memory and forcing kernel panic or degraded service. The EPSS score is less than 1%, making it difficult to gauge current exploitation likelihood. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to drive nlm_do_fopen() failures, likely by sending requests to the NFS lock manager that it rejects, which is possible from remote systems with network access to the NFS service.