The Linux kernel's nfsd component had a flaw where POSIX ACL objects allocated during nfsd4_decode_createhow4() were not released if nfsd4_decode_open_claim4() returned a non-seqid-mutating error. This caused a memory leak because the release function was only called in the normal execution path and not on error short-circuits or replayed operations. The patch introduces nfsd4_open_release() as the .op_release handler for OP_OPEN to ensure POSIX ACL references are released in all cases, and moves the op_release() call to cover both normal and replay encoding branches, preventing resource leaks.

The vulnerability results in memory leaks in the NFS server component of the Linux kernel when handling malformed OPEN compound requests with valid POSIX ACL attributes. While this does not directly enable code execution or privilege escalation, it can degrade system stability or performance due to resource exhaustion over time if exploited repeatedly.

A fix has been implemented in the Linux kernel to properly release POSIX ACL references in all code paths of the NFS server's OPEN operation. Users should update to the fixed kernel version once available. No additional mitigation is required as the patch addresses the resource leak comprehensively.