CVE-2025-71090: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71090 is a reference leak vulnerability in the Linux kernel's NFSv4 server (nfsd) subsystem, specifically in the nfsd4_add_rdaccess_to_wrdeleg() function. It affects Linux kernel version 6.17, versions 6.17.1 through 6.18.3 (inclusive), and 6.19 release candidates (rc1–rc8). The vulnerability was published on January 13, 2026, with patches added on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat, Feedly).

The root cause is an improper reference counting bug (CWE classified as "Other" by NVD) in the nfsd4_add_rdaccess_to_wrdeleg() function within the Linux kernel's NFS server implementation. The function unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file pointer without first releasing the existing reference if a client already holds a SHARE_ACCESS_READ open — orphaning the previous reference. A second flaw exists because the same nfsd_file pointer is stored in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with only a single reference count; when put_deleg_file() runs and another READ open exists, fi_access[O_RDONLY] never drops to zero, so the delegation's reference is never released. On server shutdown, these accumulated leaks cause __nfsd_file_cache_purge() to encounter objects with elevated reference counts, ultimately triggering a BUG() in kmem_cache_destroy() (Feedly).

Exploitation of this vulnerability results in a denial of service affecting the NFS server. Leaked nfsd_file references can cause open conflicts on affected files, disrupting NFS client access. On server shutdown, the unresolvable reference counts trigger a kernel BUG() assertion in kmem_cache_destroy(), causing a kernel panic. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H) (Feedly).

The Linux kernel has been patched in version 6.18.4 and in the 6.19-rc4 development branch. Two upstream commits address the issue: 8072e34e1387d03102b788677d491e2bcceef6f5 (for the 6.17.x stable series) and c07dc84ed67c5a182273171639bacbbb87c12175 (for the 6.19-rc series). Ubuntu has issued security notices USN-8277-1, USN-8277-2, USN-8310-1, and USN-8374-1 addressing this vulnerability. Administrators running affected kernel versions should update to kernel 6.18.4 or later, or apply the relevant distribution-specific security update (Ubuntu USN-8277-1, Ubuntu USN-8374-1, Red Hat).

Red Hat has acknowledged the vulnerability and published a security advisory. Ubuntu has issued multiple security notices (USN-8277-1, USN-8277-2, USN-8310-1, USN-8374-1) addressing the issue across affected kernel packages. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Red Hat, Ubuntu USN-8277-1).