CVE-2026-89714

Received Received - Intake

Memory Leak in Linux Kernel NFS Implementation

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server_common_setup() allocates server->delegation_hash_table first, but server->destroy - the only path that frees the table via nfs4_destroy_server() - is not assigned until the very end of the function. If any intermediate step fails (the is_ds_only_client() check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()), the function returns with server->destroy still NULL, so the caller's nfs_free_server() skips the destroy callback and the hash table is leaked (4 KiB per attempt with the default delegation watermark). This is trivially reachable from userspace: every failed NFSv4 mount leaks one allocation. A client that persistently retries a mount that cannot succeed leaks kernel memory without bound. Observed in production where a Longhorn backup poller retried mount.nfs4 against an NFSv3-only server roughly 10 times per second, leaking ~3.4 GiB of unreclaimable slab (kmalloc-rnd-13-4k) per day; the node accumulated 12 GiB of leaked slab before the source was identified via the kmem:kmalloc tracepoint (call_site=nfs4_delegation_hash_alloc). Reproducer: # server exports NFSv3 only (or export path absent for v4) while :; do mount -t nfs4 <server>:/missing /mnt; done # watch SUnreclaim in /proc/meminfo grow 4 KiB per iteration Free the table on the error paths between the allocation and the assignment of server->destroy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89714

EUVD

EUVD-2026-76626

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the NFS (Network File System) component. When setting up an NFSv4 server, the function nfs4_server_common_setup() allocates memory for a delegation hash table but fails to assign a cleanup callback (server->destroy) until the end of the function. If any step in the setup fails, the function exits early without setting the cleanup callback, causing the caller to skip freeing the allocated memory. This results in a 4 KiB memory leak per failed mount attempt.

Detection Guidance

Monitor slab memory usage for leaks using commands like 'cat /proc/meminfo | grep SUnreclaim' to track unreclaimable slab growth. Check for repeated NFSv4 mount failures with 'dmesg | grep nfs' or 'journalctl -u nfs-server' to identify delegation_hash_table leaks.

Impact Analysis

This vulnerability can impact you by causing gradual depletion of kernel memory. If an attacker or misconfigured client repeatedly attempts to mount an NFSv4 server that fails (e.g., due to an incompatible version or missing export), the kernel will leak 4 KiB of memory per attempt. Over time, this can lead to significant memory consumption, potentially causing system slowdowns, crashes, or denial-of-service conditions if left unchecked.

Mitigation Strategies

Apply the Linux kernel patch fixing the delegation_hash_table leak. Temporarily restrict NFSv4 mounts to trusted clients or disable NFSv4 if not required. Monitor memory usage and NFS server logs for abnormal activity.

Hi! I’m here to help you understand CVE-2026-89714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70