CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the NFSv4 CREATE operation, where the nfsd4_decode_create() function fails to properly validate the length of symlink targets, allowing clients to trigger excessive memory allocations. This can lead to potential denial-of-service conditions due to memory exhaustion, as large allocations can persist until the compound operation is completed. Organizations using NFSv4 in their Linux environments should prioritize addressing this issue to mitigate the risk of service disruptions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred. Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.