The Linux kernel's nfsd4_decode_create() function for NFSv4 CREATE operations accepted an unbounded cr_datalen value for NF4LNK symlink targets. This allowed a client to force the kernel to allocate memory up to the maximum RPC payload size (several MiB) per COMPOUND operation, which persists until the compound operation teardown. While the VFS later rejects symlink targets that exceed PATH_MAX with an ENAMETOOLONG error, the memory allocation already occurred, leading to potential resource exhaustion. The vulnerability was addressed by adding early checks to reject cr_datalen values of zero or those exceeding NFS4_MAXPATHLEN, returning nfserr_inval or nfserr_nametoolong errors respectively, thus bounding the allocation size.

An attacker could exploit this vulnerability to cause excessive memory allocation in the kernel's NFS server component by sending crafted NFSv4 CREATE requests with oversized symlink targets. This could lead to resource exhaustion and potentially degrade system performance or availability. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to validate the symlink target length early in the nfsd4_decode_create() function, rejecting invalid or oversized targets before memory allocation. Users should apply the official Linux kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly.