Executive brief
A memory leak vulnerability was identified in the Linux kernel's Network File System (NFS) server component. This issue occurs when managing the number of active server threads, causing the system to slowly lose available memory over time. If exploited or triggered repeatedly, it could lead to system instability or a complete crash, impacting the availability of file-sharing services.
Technical details
A reference count leak exists in the Linux kernel's NFSD implementation within the nfsd_nl_threads_set_doit() function. The function calls get_current_cred() to obtain a reference to the current process's credentials but fails to call put_cred() to release that reference after passing it to nfsd_svc(). Because nfsd_svc() and subsequent calls like _svc_xprt_create() perform their own reference counting (bumping the count again), the original reference obtained in the netlink handler is never freed. This results in a persistent leak of 'struct cred' objects. An attacker with local access could potentially trigger this leak repeatedly via netlink messages to exhaust system memory. The fix replaces get_current_cred() with current_cred(), which does not increment the reference count.
Affected products
- Linux Linux kernel 6.10 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory