The Linux kernel NFS server contains a flaw in the function nfsd_nl_threads_set_doit() that retrieves the current process credential with get_current_cred() and forwards it to subsequent internal routines without decreasing the reference count. Because the ownership of the reference is never released, each invocation of the function leaks a reference to struct cred, gradually consuming kernel memory until the system exhausts available address space, which can lead to a denial‑of‑service condition. The vulnerability is a memory‑leak defect (CWE‑401 and CWE‑772).

All Linux kernel releases that include the generic NFS server code prior to the application of the upstream patch are vulnerable; the supplied CPEs identify the generic kernel as well as the 7.0 release candidates (rc1 and rc2). Any configuration that enables the NFS server exposes the affected code paths.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of < 1% indicates a low current likelihood of exploitation in the wild. The vulnerability is not cataloged in CISA KEV, suggesting limited exploitation. An attacker would need to interact with the NFS service—either locally or remotely—using standard write or send message operations to repeatedly trigger the leak, potentially exhausting kernel memory over time, but does not provide a vector for privilege escalation or code execution.