Executive brief
The Linux kernel's NFS server (nfsd) component has a resource leak in its inter-server file copy feature. When copying files between NFS servers fails during setup, the kernel fails to properly release file handle references, causing memory and filesystem resources to remain pinned. Repeated failed copy operations accumulate these leaks, potentially degrading NFS server performance or causing resource exhaustion.
Technical details
The vulnerability is a resource leak (CWE-404) in the nfsd4_copy() function within fs/nfsd/nfs4proc.c. When nfsd4_setup_inter_ssc() fails during inter-server NFS4 COPY operation setup, the code returns directly with nfserr_offload_denied, bypassing the cleanup code at the out: label that calls release_copy_files(). This leaves a dangling reference to an nfsd_file object allocated by nfs4_preprocess_stateid_op(), pinning kernel file structures, inodes, dentries, and vfsmounts. The attack vector requires network access to send NFS4 COPY requests to a vulnerable nfsd; no authentication bypass or privilege escalation is required. Fix: set status and jump to out: instead of returning directly.
Affected products
- Linux Linux kernel Multiple versions (patch applied to stable series 4.x–7.x)
Timeline
- 2026-09-11: disclosed: CVE-2026-89680 published
- 2026-05-31: patched: Upstream commit 88a76145451d703eedd867b5989bf73d17340399 authored by Jeff Layton
- 2026-09-07: patched: Backported to stable kernel series