Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local user to cause a system resource leak. The issue occurs when managing network listeners, where the system fails to properly release security credentials after use. Over time, this can lead to memory exhaustion, potentially causing the system to crash or become unresponsive.
Technical details
A memory leak (CWE-401) exists in the nfsd_nl_listener_set_doit() function within fs/nfsd/nfsctl.c. The function incorrectly uses get_current_cred() to increment a credential reference count without a corresponding put_cred() call to release it. Because the function operates within a process context where the credential reference is already stable, the additional reference is unnecessary and never freed. A local attacker can exploit this by repeatedly triggering the affected netlink command to exhaust kernel memory, leading to a denial of service. The issue has been patched by switching to current_cred(), which does not increment the reference count.
Affected products
- Linux Linux Kernel 6.10 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-01-24: patched: Initial patch authored