A flaw in the fsidd component of nfs-utils allows a local user to send malformed requests to its local domain socket, which bypasses argument validation that is instead guarded by assertions. When an assertion fails the daemon crashes, aborting filesystem identifier lookup services and causing a denial of service until the daemon is restarted.

Red Hat maintains nfs-utils for its Enterprise Linux distributions and OpenShift Container Platform. The vulnerability affects all Red Hat Enterprise Linux releases 6 through 10 and all variants of OpenShift Container Platform 4 that include the default nfs-utils package. The affected component is the fsidd daemon; specific patch level information is not supplied in the advisory.

The CVSS base score of 5.5 indicates moderate severity. Because the exploit requires local access to the socket, it is limited to users who can communicate with the system without elevated privileges. No publicly known exploits or KEV listing exist, and the EPSS score is not available, suggesting low to moderate exploitation probability. However, the crash can be repeatedly triggered without additional privileges, so environments that provide local users with unrestricted access to IPC resources should be reviewed immediately.