Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s NFS server can mishandle internal accounting when an NFSv4 copy operation fails. The published severity indicates a remote, unauthenticated attacker may be able to disrupt availability, but the supplied sources do not describe the precise failure outcome or confirm exploitation.
Executive priority
Treat this as a high-priority availability issue for exposed or business-critical NFS servers. Patch through supported vendor channels after normal compatibility testing. Systems not providing NFSD are unlikely to be directly exposed based on the supplied description.
Technical view
The nfsd4_copy() error path calls cleanup_async_copy(), which already decrements pending_async_copies, then incorrectly decrements it again. This corrupts NFSD asynchronous-copy accounting. CVSS 3.1 rates the issue 7.5 with network access, low complexity, no privileges or interaction, and availability impact only.
Likely exposure
Exposure is most likely limited to Linux systems running NFSD and using the affected NFSv4 copy-processing code. The bundle marks 6.10.14 and 6.11.3 as unaffected, but does not provide clear vulnerable version ranges. Distribution-specific kernel backports make package-level verification necessary.
Exploitation context
The CVSS vector describes remote, unauthenticated, low-complexity availability impact. The bundle reports that the CVE is not in KEV and provides no evidence of active exploitation or a public proof of concept. Exact triggering conditions beyond an error during NFS copy processing are not documented here.
Researcher notes
The defect is a double decrement of pending_async_copies on the nfsd4_copy() error path. The sources establish faulty accounting and availability severity but do not explain the resulting kernel state, reliable reachability, or affected configuration boundaries. Avoid deriving exact vulnerable ranges from the listed commit hashes without vendor mapping.
Mitigation direction
- Check the Linux distribution or kernel vendor’s guidance for affected package versions.
- Upgrade to a supported kernel package incorporating the applicable referenced stable fix.
- Prioritize externally reachable or broadly accessible NFSD servers.
- If patching is delayed, consider disabling NFSD where it is not operationally required.
Validation and detection
- Identify systems running NFSD and record their exact kernel package versions.
- Map each running package to vendor advisories and backport documentation.
- Confirm the installed kernel contains the applicable referenced stable fix.
- After updating, verify the new kernel is running and NFSD operates normally.
- Review monitoring for unexplained NFS service interruptions or kernel availability events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-53073 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ed98d26021db0fe62c327aa9f5e57a90bff3fa94CVE reference, Linux
- https://git.kernel.org/stable/c/9467c49437e948c541569007cd412d577942e635CVE reference, Linux
- https://git.kernel.org/stable/c/949ee5d44d1fd95119b29b3382a933cdc617bf9eCVE reference, Linux
- https://git.kernel.org/stable/c/fb79d68a36e21960341ccab07d1ac06d93830321CVE reference, Linux
- https://git.kernel.org/stable/c/1421883aa30c5d26bc3370e2d19cb350f0d5ca28CVE reference, Linux
- https://git.kernel.org/stable/c/8286f8b622990194207df9ab852e0f87c60d35e9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.