« Volver al listado

CVE-2025-71090

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()

nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCESS_READ open from a previous OPEN operation, this action overwrites the existing pointer without releasing its reference, orphaning the previous reference.

Additionally, the function originally stored the same nfsd_file pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file.

Leer descripción completaMostrar menos

However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released. This potentially causes open conflicts on that file.

Then, on server shutdown, these leaks cause __nfsd_file_cache_purge() to encounter files with an elevated reference count that cannot be cleaned up, ultimately triggering a BUG() in kmem_cache_destroy() because there are still nfsd_file objects allocated in that cache.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-71090",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e7a8ebc305f26cab608e59a916a4ae89d6656c5f",
              "lessThan": "c07dc84ed67c5a182273171639bacbbb87c12175",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e7a8ebc305f26cab608e59a916a4ae89d6656c5f",
              "lessThan": "8072e34e1387d03102b788677d491e2bcceef6f5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-13T16:16:08.700",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/8072e34e1387d03102b788677d491e2bcceef6f5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c07dc84ed67c5a182273171639bacbbb87c12175",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()\n\nnfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites\nfp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if\nthe client already has a SHARE_ACCESS_READ open from a previous OPEN\noperation, this action overwrites the existing pointer without\nreleasing its reference, orphaning the previous reference.\n\nAdditionally, the function originally stored the same nfsd_file\npointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with\nonly a single reference. When put_deleg_file() runs, it clears\nfi_rdeleg_file and calls nfs4_file_put_access() to release the file.\n\nHowever, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when\nthe fi_access[O_RDONLY] counter drops to zero. If another READ open\nexists on the file, the counter remains elevated and the nfsd_file\nreference from the delegation is never released. This potentially\ncauses open conflicts on that file.\n\nThen, on server shutdown, these leaks cause __nfsd_file_cache_purge()\nto encounter files with an elevated reference count that cannot be\ncleaned up, ultimately triggering a BUG() in kmem_cache_destroy()\nbecause there are still nfsd_file objects allocated in that cache."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfsd: corregir fuga de referencia de nfsd_file en nfsd4_add_rdaccess_to_wrdeleg()\n\nnfsd4_add_rdaccess_to_wrdeleg() sobrescribe incondicionalmente fp->fi_fds[O_RDONLY] con un nfsd_file recién adquirido. Sin embargo, si el cliente ya tiene una apertura SHARE_ACCESS_READ de una operación OPEN anterior, esta acción sobrescribe el puntero existente sin liberar su referencia, dejando huérfana la referencia anterior.\n\nAdemás, la función originalmente almacenaba el mismo puntero nfsd_file tanto en fp->fi_fds[O_RDONLY] como en fp->fi_rdeleg_file con una sola referencia. Cuando se ejecuta put_deleg_file(), borra fi_rdeleg_file y llama a nfs4_file_put_access() para liberar el archivo.\n\nSin embargo, nfs4_file_put_access() solo libera fi_fds[O_RDONLY] cuando el contador fi_access[O_RDONLY] cae a cero. Si existe otra apertura READ en el archivo, el contador permanece elevado y la referencia nfsd_file de la delegación nunca se libera. Esto potencialmente causa conflictos de apertura en ese archivo.\n\nLuego, al apagar el servidor, estas fugas hacen que __nfsd_file_cache_purge() encuentre archivos con un recuento de referencias elevado que no pueden ser limpiados, lo que finalmente dispara un BUG() en kmem_cache_destroy() porque todavía hay objetos nfsd_file asignados en esa caché."
    }
  ],
  "lastModified": "2026-07-30T06:24:50.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "312F9EA6-4B54-4FDE-90FB-1414FF6BD0E6",
              "versionEndExcluding": "6.18.4",
              "versionStartIncluding": "6.17.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}