CVE-2025-71090

A reference leak flaw was found in the Linux kernel's NFSv4 server (nfsd). The nfsd4_add_rdaccess_to_wrdeleg() function overwrites file pointers without releasing existing references, causing nfsd_file reference leaks. On server shutdown, these leaked references trigger a BUG() in kmem_cache_destroy() as objects cannot be freed.

This affects NFS servers serving NFSv4 clients using delegations. The leaks accumulate during normal operation with delegation upgrades. Server shutdown fails with a kernel BUG due to unfreed slab objects. Non-NFS systems are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.