CVE-2024-41076: NFSv4: Fix memory leak in nfs4_set_security_label
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: Fix memory leak in nfs4setsecuritylabel
We leak nfsfattr and nfs4label every time we set a security xattr.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a flaw in NFSv4. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41076?
CVE-2024-41076 has a high severity rating due to the potential for memory leaks in NFSv4 functionality.
How do I fix CVE-2024-41076?
To fix CVE-2024-41076, upgrade the Linux kernel to versions 6.1.101, 6.6.42, 6.9.11, 6.10, or applicable Debian kernels listed in the vulnerability report.
What impact does CVE-2024-41076 have on systems using the Linux kernel?
CVE-2024-41076 can lead to excessive memory usage over time due to memory leaks when setting security extended attributes in NFSv4.
Which Linux kernel versions are affected by CVE-2024-41076?
Versions prior to 6.1.101, between 6.2 and 6.6.42, and between 6.7 to 6.9.11 of the Linux kernel are affected by CVE-2024-41076.
Is there a workaround for CVE-2024-41076 if I cannot apply the patch immediately?
Currently, there are no known workarounds for CVE-2024-41076; it is recommended to apply the appropriate patches as soon as possible.