Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local user to cause a system resource leak. The issue occurs when handling directory delegations, a feature used to improve file access performance. Over time, this leak could lead to system instability or a denial-of-service condition as system memory or resources are exhausted.
Technical details
A reference count leak was identified in the Linux kernel's NFSD (NFS server) implementation within the nfsd_get_dir_deleg() function in fs/nfsd/nfs4state.c. The vulnerability stems from a failure to release the reference to the 'nfs4_file' structure (fp) before returning, both in successful execution paths and certain error paths. An attacker with local access could potentially trigger this leak repeatedly to exhaust kernel memory or reference count limits, leading to a denial-of-service (DoS) condition. The issue was introduced during the implementation of GET_DIR_DELEGATION handling and has been resolved by ensuring put_nfs4_file(fp) is called appropriately before the function returns.
Affected products
- Linux Linux Kernel 6.19 to 6.19.6
Timeline
- 2025-12-13: other: Patch authored
- 2026-01-26: other: Patch committed to mainline
- 2026-05-06: disclosed: CVE published
- 2026-05-11: advisory: NVD enrichment and analysis completed