In the Linux kernel, the following vulnerability has been resolved:
nfsd: put dlstid if fail to queue dlrecall
Before calling nfsd4runcb to queue dlrecall to the callbackwq, we increment the reference count of dlstid. We expect that after the corresponding workstruct is processed, the reference count of dlstid will be decremented through the callback function nfsd4cbrecallrelease. However, if the call to nfsd4runcb fails, the incremented reference count of dlstid will not be decremented correspondingly, leading to the following nfs4stid leak: unreferenced object 0xffff88812067b578 (size 344): comm "nfsd", pid 2761, jiffies 4295044002 (age 5541.241s) hex dump (first 32 bytes): 01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff ....kkkk........ 00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de .kkkkkkk.....N.. backtrace: kmemcachealloc+0x4b9/0x700 nfsd4processopen1+0x34/0x300 nfsd4open+0x2d1/0x9d0 nfsd4proccompound+0x7a2/0xe30 nfsddispatch+0x241/0x3e0 svcprocesscommon+0x5d3/0xcc0 svcprocess+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 retfromfork+0x30/0x50 retfromforkasm+0x1b/0x30 unreferenced object 0xffff8881499f4d28 (size 368): comm "nfsd", pid 2761, jiffies 4295044005 (age 5541.239s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff ........0M.I.... 30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00 0M.I.... ....... backtrace: kmemcachealloc+0x4b9/0x700 nfs4allocstid+0x29/0x210 allocinitdeleg+0x92/0x2e0 nfs4setdelegation+0x284/0xc00 nfs4opendelegation+0x216/0x3f0 nfsd4processopen2+0x2b3/0xee0 nfsd4open+0x770/0x9d0 nfsd4proccompound+0x7a2/0xe30 nfsddispatch+0x241/0x3e0 svcprocesscommon+0x5d3/0xcc0 svcprocess+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 retfromfork+0x30/0x50 retfromforkasm+0x1b/0x30 Fix it by checking the result of nfsd4runcb and call nfs4putstid if fail to queue dl_recall.
[
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-0d060011",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdb796137c57e68ca34518d53be53b679351eb86",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-21d613a0",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@230ca758453c63bd38e4d9f4a21db698f7abada8",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-27a521b8",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b874cdef4e67e5150e07eff0eae1cbb21fb92da1",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-3bdfaca5",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@133f5e2a37ce08c82d24e8fba65e0a81deae4609",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-3cdc3f2a",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "338233881761938137922011192703623203954",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "25415872639554779657495003237259290855"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b874cdef4e67e5150e07eff0eae1cbb21fb92da1",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-79aa1889",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "23180229919275975509049692346534918891",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "259760087904379373919278601369320705645"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@230ca758453c63bd38e4d9f4a21db698f7abada8",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-96a6c4fd",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "23180229919275975509049692346534918891",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "259760087904379373919278601369320705645"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b91c8ff4589f5263873b24c052447a28e10ef7",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-a12f3efd",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "23180229919275975509049692346534918891",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "259760087904379373919278601369320705645"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@133f5e2a37ce08c82d24e8fba65e0a81deae4609",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-b5e0020c",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "23180229919275975509049692346534918891",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "259760087904379373919278601369320705645"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad3479b63661a399c9df1d0b759e1806e2df3c8",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-b9dd88bd",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63b91c8ff4589f5263873b24c052447a28e10ef7",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-c1214464",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d96587cc93ec369031bcd7658c6adc719873c9fd",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-c615a3a2",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "338233881761938137922011192703623203954",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "25415872639554779657495003237259290855"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d96587cc93ec369031bcd7658c6adc719873c9fd",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-d0b0031a",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-d57dbec0",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "338233881761938137922011192703623203954",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "25415872639554779657495003237259290855"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2025-22025-f7dec7a4",
        "digest": {
            "line_hashes": [
                "296199400495796077181920537314022726042",
                "24478930952479137071489702820153499750",
                "126565835694233765215142070197723267482",
                "338233881761938137922011192703623203954",
                "145862561974960597157148293638418994545",
                "228324913232680902703432397273716676712",
                "132325602728086348372949074605769908469",
                "139352135591414627047532765600540686121",
                "25415872639554779657495003237259290855"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdb796137c57e68ca34518d53be53b679351eb86",
        "target": {
            "file": "fs/nfsd/nfs4state.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2025-22025-fbd491a6",
        "digest": {
            "length": 139.0,
            "function_hash": "296161787181447978128771983614803139922"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad3479b63661a399c9df1d0b759e1806e2df3c8",
        "target": {
            "function": "nfsd_break_one_deleg",
            "file": "fs/nfsd/nfs4state.c"
        }
    }
]