CVE-2023-53606: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53606 is a vulnerability discovered in the Linux kernel related to potential nfsd_file refcount leaks in the COPY codepath. The vulnerability was published on October 4, 2025, and affects the Linux kernel's Network File System daemon (nfsd) implementation (NVD).

The vulnerability involves two different types of nfsd4copy struct implementations. One is embedded in the compound and used for synchronous copies, while the other is dynamically allocated, refcounted, and tracked in the client structure. A refcount leak occurs when the kthreadcreate call fails, causing both the src and dst nfsdfiles in the original nfsd4copy object to leak. The vulnerability has been assigned a CVSS v3.1 score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The vulnerability can lead to resource leaks in the Linux kernel's NFS server implementation, potentially affecting system stability and resource management (NVD).

Multiple Linux distributions have released fixes for this vulnerability. Debian has addressed the issue in various versions including bullseye (5.10.244-1), bookworm (6.1.153-1), trixie (6.12.48-1), and sid (6.16.12-2) (Debian).