CVE-2026-89707

Status: UPDATED  |  Advisory ID: CVE-2026-89707

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release path refs on follow_down() error

nfsd_cross_mnt() initializes a local struct path with mntget() and

dget() before calling follow_down(). On a negative return the error

arm jumps to out without releasing those references:

err = follow_down(&path, follow_flags);

if (err < 0)

goto out;

follow_down() never drops the caller's entry-time refs on any error

sub-case; for example a pre-cross d_manage() failure leaves path

untouched, so the mntget()/dget() taken on entry survive the call.

Every other early-exit arm in nfsd_cross_mnt() (other-namespace

return, IS_ERR(exp2), and the success tail after the swap) already

calls path_put(&path); the err < 0 arm is the lone omission. The

leak inflates mnt_count and d_count on each failed cross-mount,

blocking umount and pinning dentries against the shrinker, and is

reachable by any authenticated NFS client through nfsd_lookup_dentry

or the NFSv4 READDIR encode path.

Fix by calling path_put(&path) before the goto out in the err < 0

arm so the entry-time refs are released on all follow_down() error

returns. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References