CVE-2025-22025

A flaw was found in the Linux kernel's Network File System daemon (nfsd). When the server fails to queue a delegation recall request, it fails to release the associated state reference, causing an internal memory leak. A client interacting with an NFS server could repeatedly trigger this condition, eventually exhausting kernel memory and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate because it results in a denial of service through an internal memory leak without enabling code execution, privilege escalation, or data compromise. Exploitation requires the system to be actively configured and running as an NFSv4 server processing stateful delegation requests. Red Hat Enterprise Linux systems that do not export NFS shares or that function solely as NFS clients are unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.