Executive brief
The Linux kernel's NFS v4 implementation has a memory leak in the network mount setup code. When an NFSv4 mount attempt fails during initialization, a 4 KB memory allocation is not freed, allowing attackers or misconfigured clients to exhaust system memory through repeated failed mount requests. A production case showed 3.4 GB of memory leaked per day on a node receiving ~10 mount attempts per second.
Technical details
This is a resource leak (CWE-401) in the Linux kernel's nfs4_server_common_setup() function. The vulnerability occurs when delegation_hash_table is allocated early in the function, but the server->destroy callback pointer—which is responsible for freeing the table via nfs4_destroy_server()—is not assigned until the very end of the function. If any of several intermediate initialization steps fail (is_ds_only_client() check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()), the function returns with server->destroy still NULL, causing nfs_free_server() to skip the destroy callback and leak the allocation. The attack vector is network-adjacent or local; any user can trigger this by attempting to mount an NFSv3-only export as NFSv4 or a non-existent path. The fix is to free the delegation_hash_table on error paths before returning.
Affected products
- Linux Linux kernel multiple
Timeline
- 2026-09-11: disclosed