PT-2025-37682 · Nfsd+8 · Nfsd+9

Published 2023-11-07 · Updated 2026-04-14 · CVE-2023-53241

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue where the op release function is not consistently called, even when op func returns an error. This can lead to a memory leak in the layoutget codepath, specifically within the Network File System (NFS) daemon (nfsd) when handling operations with "trivial" replies. The nfsd4 encode operation function skips calling op release under certain conditions, causing the memory leak. Additionally, nfsd4 block get device info scsi needs to set the gd device pointer to NULL on error to prevent a double free.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2025_16880

BDU:2026-05879

CESA-2023_7077

CVE-2023-53241

OESA-2025-2406

OESA-2025-2407

OESA-2025-2408

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:03615-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Astra Linux

Centos

Linux Kernel

Nfs

Red Hat

Red Os

Suse

Nfsd

Nfsd4 Block Get Device Info Scsi

Nfsd4 Encode Operation

References · 913

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53241.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53241 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39866 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2406 · Vendor Advisory
• https://git.kernel.org/stable/c/65a33135e91e6dd661ecdf1194b9d90c49ae3570 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53331 · Security Note
• https://bdu.fstec.ru/vul/2026-05879 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50330 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39752 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53215 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53339 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-53241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53437 · Security Note