CVE-2026-89707

Received Received - Intake

Reference Leak in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references: err = follow_down(&path, follow_flags); if (err < 0) goto out; follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89707

EUVD

EUVD-2026-76619

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the NFS server (nfsd) when handling mount points. When follow_down() fails, the code jumps to an error path without releasing references taken earlier with mntget() and dget(). This causes memory and dentry leaks, increasing reference counts and blocking unmount operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server implementation and may not have direct detection commands. Monitor kernel logs for NFS-related errors or warnings, particularly during mount operations or cross-mount failures. Check for increased mnt_count and d_count values using commands like cat /proc/self/mountinfo or ls -l /proc/*/fd/ to identify potential reference leaks.

Impact Analysis

An authenticated NFS client could trigger this flaw, causing memory leaks that inflate reference counts. This may lead to system instability, prevent unmounting filesystems, and pin dentries in memory, potentially causing performance degradation or denial of service.

Mitigation Strategies

Apply the kernel patch that fixes the reference leak in nfsd_cross_mnt(). If a patch is not yet available, restrict access to NFS services by disabling the NFS server or using firewall rules to limit client access. Monitor system behavior for signs of dentry or mount reference leaks, such as failed umount operations or increased memory usage.

Hi! I’m here to help you understand CVE-2026-89707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70