PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71090 Linux CVE debrief

A vulnerability in the Linux kernel's nfsd subsystem has been identified. The nfsd4_add_rdaccess_to_wrdeleg() function was found to leak a reference to a nfsd_file object, potentially leading to open conflicts on files and causing the __nfsd_file_cache_purge() function to encounter files with elevated reference counts that cannot be cleaned up. This issue arises when a client already has a SHARE_ACCESS_READ open from a previous OPEN operation, and the function overwrites the existing pointer without releasing its reference, orphaning the previous reference. Furthermore, the function originally stored the same nfsd_file pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file. However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-13
Original CVE updated
2026-07-30
Advisory published
2026-01-13
Advisory updated
2026-07-30

Who should care

Linux kernel users and administrators, as well as developers and security teams responsible for maintaining and securing Linux-based systems, should be aware of this vulnerability. They should review system configurations, ensure that Linux kernel versions are up-to-date, and monitor system logs for potential open conflicts on files. Additionally, they should assess their exposure to this vulnerability and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked, and exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and vulnerability management processes should be updated to reflect the potential impact of this vulnerability. Security teams should prioritize patching and mitigation efforts based on the potential operational impact of this vulnerability. Linux kernel developers and maintainers should also review the nfsd subsystem to prevent similar issues in the future. System administrators should be prepared to handle potential denial of service and data corruption scenarios. Linux distribution maintainers should ensure that patched versions are made available to users. Security researchers should continue to monitor for potential exploits and report any findings to the relevant authorities. Users of Linux-based systems should be aware of the potential risks associated with this vulnerability and take steps to mitigate them. The Linux kernel community should review and test patches to ensure that they are effective and do not introduce new vulnerabilities. System administrators and security teams should also review and update their incident response plans to address potential exploitation of this vulnerability. Linux kernel users should track changes to the Linux kernel and be prepared to apply patches as they become available. Security teams should also review and update their vulnerability management processes to ensure that similar vulnerabilities are addressed in a tim

Technical summary

The nfsd4_add_rdaccess_to_wrdeleg() function in the Linux kernel's nfsd subsystem does not properly handle the case where a client already has a SHARE_ACCESS_READ open from a previous OPEN operation, leading to a reference leak and potential open conflicts on files. This occurs because the function overwrites the existing nfsd_file pointer in fp->fi_fds[O_RDONLY] without releasing the reference, causing the previous reference to be orphaned. As a result, the nfsd_file reference from the delegation is never released, potentially causing open conflicts on files and leading to elevated reference counts that cannot be cleaned up.

Defensive priority

High priority due to potential for denial of service and data corruption.

Recommended defensive actions

  • Apply patches provided by the Linux kernel maintainers
  • Review and update Linux kernel versions to ensure affected versions are patched
  • Monitor system logs for potential open conflicts on files
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced in the Linux kernel and affects various versions. The nfsd4_add_rdaccess_to_wrdeleg() function does not properly handle the case where a client already has a SHARE_ACCESS_READ open from a previous OPEN operation, leading to a reference leak. Evidence is limited to CVE and NVD records, which may not provide a comprehensive view of affected scope, severity, or vendor guidance. Defenders should verify system configurations, review logs for potential open conflicts on files, and ensure that Linux kernel versions are up-to-date.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-01-13T16:16:08.700Z and has not been modified since then. The NVD entry is currently Modified.