The vulnerability in the Linux kernel NFSv4.2 subsystem involves the encoding of layout statistics (LAYOUTSTATS) for pNFS layout updates. The macro encode_layoutstats_maxsz originally budgets 256 bytes for the layoutupdate4 body, but the actual data, including filehandle and address information controlled by the server, can exceed this size. When the send buffer is exhausted, xdr_reserve_space() returns NULL, causing functions that hold locks to fail to release them, resulting in a permanent lock. The patch raises PNFS_LAYOUTSTATS_MAXSIZE to 384 bytes to ensure the record fits within the buffer reservation, preventing buffer exhaustion and lock retention.

The vulnerability can cause a denial of service condition by exhausting the send buffer during layout statistics encoding, which leads to a NULL pointer return and a lock being permanently held. This results in an availability impact (denial of service) without compromising confidentiality or integrity.

A fix is available that increases the buffer size to prevent exhaustion and the associated lock retention. Users should apply the official Linux kernel patch that raises PNFS_LAYOUTSTATS_MAXSIZE to 384 bytes. No additional mitigation is indicated.