Executive brief
The Linux kernel's NFS server daemon (nfsd) contains a memory leak in its filehandle processing code. When an NFS client sends a specially crafted NFSv3 filehandle targeting a V4ROOT export, the kernel fails to properly release an internal filesystem reference on each request, potentially allowing attackers to exhaust kernel memory and cause a denial of service.
Technical details
The vulnerability is a reference leak in the nfsd_set_fh_dentry() function in fs/nfsd/nfsfh.c. When handling NFS3_FHSIZE or NFS_FHSIZE filehandles, if an export is marked with the NFSEXP_V4ROOT flag, the code jumps to the out: label without properly releasing the dentry reference obtained from exportfs_decode_fh_raw(). The out: label calls exp_put() but never calls dput() on the dentry, and since fhp->fh_dentry is never assigned, the cleanup in fh_put() cannot compensate. A crafted NFSv3 filehandle targeting a V4ROOT export's filesystem ID triggers this leak on every request. The fix, added in commit 6247023fbec and backported through commit 11db8df18, adds explicit dput(dentry) calls before the goto out statements to properly release the reference.
Affected products
- Linux Linux kernel Versions prior to the fix; affects multiple stable series
Timeline
- 2026-09-11: disclosed: Published as CVE-2026-89683
- 2026-08-10: patched: Fix merged upstream (commit 6247023fbec)
- 2026-09-07: patched: Fix backported to stable kernels (commit 11db8df18)