CVE-2024-41076

What it actually does

Memory leak of nfs_fattr and nfs4_label structures occurs on every invocation of nfs4_set_security_label when setting security xattrs over NFSv4.

Why it matters to the business

Systems running NFSv4 workloads with security labels experience gradual memory exhaustion that can degrade performance or trigger crashes after sustained use; the issue affects widely deployed Linux kernel versions and has no active exploitation or ransomware association.

How an attack unfolds

An attacker with NFSv4 mount access repeatedly issues operations that set security extended attributes, triggering the leak of kernel structures on each call until memory pressure causes denial of service.

How to fix it

Update the Linux kernel to a version containing commit 899604a7c958771840941caff9ee3dd8193d984c or later; rebuild and reboot affected systems, or apply vendor-supplied backports for supported distributions.

How to confirm the fix worked

Confirm the running kernel contains commit 899604a7c958771840941caff9ee3dd8193d984c or a later equivalent; inspect nfs4_set_security_label callers and verify absence of the leaked allocations under repeated security xattr operations.

Typical attack path

1. Obtain NFSv4 mount credentials or network access to a target export
2. Repeatedly perform setxattr or equivalent security label operations over NFSv4
3. Monitor for gradual memory consumption on the server until resource exhaustion

How to detect it

Review kernel memory accounting and slab statistics for repeated allocations of nfs_fattr and nfs4_label objects during NFSv4 security xattr operations; correlate with audit logs of setxattr calls over NFSv4 mounts.

What your security team should do

• Prioritize kernel upgrades on all NFSv4 servers handling security labels
• Monitor memory usage on NFS servers for unexpected growth correlated with xattr activity
• Restrict NFSv4 security label modifications to trusted clients until patches are applied