The Linux kernel's nfs4_server_common_setup() function allocates server->delegation_hash_table early but only assigns server->destroy, which frees this table, at the end of the function. If intermediate steps fail (such as is_ds_only_client() check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()), the function returns with server->destroy still NULL. Consequently, the caller's nfs_free_server() skips the destroy callback, leaking the delegation_hash_table memory (4 KiB per failed mount attempt). This leak is trivially reachable from userspace by repeatedly attempting to mount an NFSv4 share on a server that only supports NFSv3 or has no NFSv4 export path. In production, this caused significant kernel memory leaks, e.g., 3.4 GiB per day and up to 12 GiB accumulated before detection.

The vulnerability causes a kernel memory leak on every failed NFSv4 mount attempt, which can lead to significant unreclaimable kernel memory consumption over time. This can degrade system stability and performance, especially on systems that repeatedly attempt failing NFSv4 mounts. There is no indication of direct code execution or privilege escalation from this leak alone.

A fix has been implemented in the Linux kernel to free the delegation_hash_table on all error paths before server->destroy is assigned. Users should update to a Linux kernel version that includes this fix once available. Until then, avoiding repeated failed NFSv4 mount attempts can mitigate memory leak accumulation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.