PT-2025-3326 · Linux+8 · Linux Kernel+8
Yang Erkun
·
Published
2025-01-08
·
Updated
2025-10-03
·
CVE-2024-56779
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc6+
Description
A memory leak vulnerability has been resolved in the Linux kernel. The issue occurs when concurrent nfsd4 open requests are made, causing the nfsd to lose track of nfs4 openowner, leading to a memory leak. This situation can happen when two rpc task attempt to open the same file simultaneously from the client to the server, and two instances of nfsd run concurrently. Additionally, when echoing 0 to /proc/fs/nfsd/threads, a warning will be triggered.
Recommendations
For Linux kernel versions prior to 6.12.0-rc6+, update to a newer version that contains the fix for this issue.
As a temporary workaround, consider restricting access to the vulnerable nfsd module to minimize the risk of exploitation.
Avoid using the
nfsd4 open function in the affected API endpoint until the issue is resolved.
Restrict the use of the umount -f command to prevent the memory leak.Exploit
Fix
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu