Reference Leak Vulnerability in Linux Kernel's Netfs Component

CVE-2025-40007

What is CVE-2025-40007?

A vulnerability has been identified in the Linux kernel's netfs component due to improper handling of reference counters in I/O operations. When a request is released before the I/O operation is completed, it results in a reference leak, which can block server tasks and eventually cause server cluster outages. The issue arises from modifications aimed at optimizing the request handling, leading to scenarios where requests remain uncompleted, thus leaving memory resources tied up unnecessarily. A patch has been implemented to address this flaw, introducing a new function to clean up failed requests and ensure proper management of reference counts for robust and reliable operations.

References