CVE-2025-71090

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()

nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites

fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if

the client already has a SHARE_ACCESS_READ open from a previous OPEN

operation, this action overwrites the existing pointer without

releasing its reference, orphaning the previous reference.

Additionally, the function originally stored the same nfsd_file

pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with

only a single reference. When put_deleg_file() runs, it clears

fi_rdeleg_file and calls nfs4_file_put_access() to release the file.

However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when

the fi_access[O_RDONLY] counter drops to zero. If another READ open

exists on the file, the counter remains elevated and the nfsd_file

reference from the delegation is never released. This potentially

causes open

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References