A refcount leak was discovered in the Linux NFS daemon, where the function nfsd_nl_listener_set_doit() obtained a credential reference using get_current_cred() but failed to release it with put_cred(). This oversight causes the kernel to retain unnecessary credential objects, which can grow unbounded in long‑running or high‑traffic NFS operations. While the leak alone does not directly grant elevated privileges, an attacker could potentially amplify the dysfunction by repeatedly invoking the vulnerable path, leading to kernel memory exhaustion and a denial of service.

All Linux kernel implementations prior to the inclusion of the fix (commit 019debe5851d7355bea9ff0248cc317878924d8f) are affected. The vulnerability is present across all architectures that compile the NFS server module and is not limited to a particular distribution.

The exploit requires access to the kernel’s NFS subsystem, implying local or privileged execution capability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current likelihood of exploitation is uncertain. Nonetheless, the CVSS score is 5.5, indicating a moderate impact. From the description, the likely attack vector is local exploitation calling the NFS or sendmsg path. An attacker with local privileges could repeatedly trigger the leak, increasing the risk of resource exhaustion or stability degradation.