Executive brief
The Linux kernel's NFSv4 server implementation (NFSD) has a memory leak in its file copying code path. When asynchronous copy operations fail during thread creation, file references are not properly released, causing kernel memory to accumulate and potentially leading to resource exhaustion or system instability.
Technical details
The vulnerability is a resource leak (refcount leak) in the nfsd4_copy codepath of the Linux kernel's NFS server (fs/nfsd/nfs4proc.c). When kthread_create() fails during async copy operations, the src and dst nfsd_file references held by the embedded nfsd4_copy struct are not released, causing them to be leaked. The issue affects both inter-server (cross-server) and intra-server copy operations. No user interaction or authentication bypass is required; the leak occurs server-side during normal NFS copy operation handling. The fix ensures all nfsd_file references are properly cleaned up before the copy operation returns, regardless of whether it's async or sync. Patches are available in Linux mainline.
Affected products
- Linux Linux kernel multiple versions (patched in mainline and stable series)
Timeline
- 2023-01-17: disclosed
- 2023-02-20: patched
- 2025-10-04: advisory