CVE-2023-53606

A reference leak flaw was found in the Linux kernel's NFS server implementation in the file copy operation handling. A local user can trigger this issue when asynchronous copy operations fail to create worker threads, causing nfsd_file references held by the embedded copy structure to leak. This results in permanent reference leaks preventing proper file cleanup and leading to resource exhaustion and denial of service.

The NFSD COPY operation supports both synchronous and asynchronous modes. For synchronous copies, an nfsd4_copy structure is embedded in the compound and holds nfsd_file references for the duration of the operation. For asynchronous copies, a separate dynamically allocated structure is created with its own references. The cleanup logic is asymmetric—the async copy structure releases its references in nfsd4_do_async_copy, but this function also releases the references from the embedded structure, even though that structure outlives the async operation. Additionally, if kthread_create fails for async copies, neither set of references is properly released, creating a permanent leak. The fix ensures embedded structure references are always cleaned up before the function returns and consolidates cleanup logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.