CVE-2025-71090

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCESS_READ open from a previous OPEN operation, this action overwrites the existing pointer without releasing its reference, orphaning the previous reference. Additionally, the function originally stored the same nfsd_file pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file. However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released. This potentially causes open conflicts on that file. Then, on server shutdown, these leaks cause __nfsd_file_cache_purge() to encounter files with an elevated reference count that cannot be cleaned up, ultimately triggering a BUG() in kmem_cache_destroy() because there are still nfsd_file objects allocated in that cache.

• https://git.kernel.org/stable/c/8072e34e1387d03102b788677d491e2bcceef6f5Patch
• https://git.kernel.org/stable/c/c07dc84ed67c5a182273171639bacbbb87c12175Patch

Published

Jan 13, 2026

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71085In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71086In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-71087In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71088In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71089In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-7109A vulnerability, which was classified as problematic, has be…5.4
• CVE-2025-71091In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-71092In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-71093In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-71094In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71095In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71096In the Linux kernel, the following vulnerability has been re…5.5