CVE-2024-56779
A memory leak in the Linux NFS server can grow unbounded when multiple clients open files at the same time. The bug causes the server to keep unused open state objects, eventually exhausting memory and potentially crashing the system. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server, all versions before the patch. Linux system administrators and users running NFS services are affected.
Real-world impact
An attacker could trigger the leak by repeatedly opening files over NFS, causing the server to consume all available memory and crash, leading to a denial‑of‑service for legitimate users.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network without authentication, and it can compromise confidentiality, integrity, and availability by exhausting system resources.
What to do about it
- 01Update the Linux kernel to a version that includes the nfsd: fix nfs4_openowner leak patch.
- 02Reboot the system or reload the kernel to apply the update.
NVD description indicates fix
Timeline
- Jan 8, 2025 · Jan 8, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/0ab0a3ad24e970e894…patch
- git.kernel.org/stable/c/2d505a801e57428057…patch
- git.kernel.org/stable/c/37dfc81266d3a32294…patch
- git.kernel.org/stable/c/45abb68c941ebc9a35…patch
- git.kernel.org/stable/c/6f73f920b7ad008437…patch
- git.kernel.org/stable/c/98100e88dd8865999d…patch
- git.kernel.org/stable/c/a85364f0d30dee01c5…patch
- lists.debian.org/debian-lts-announce/2025/03…
- lists.debian.org/debian-lts-announce/2025/03…