Executive brief
The Linux kernel's NFS server (nfsd) contains a resource leak in its cross-mount handling code. When a mount transition fails, the kernel fails to release internal reference counts on filesystem objects, causing memory and filesystem resources to become pinned and unavailable for reuse. Any authenticated NFS client can trigger this condition repeatedly, potentially blocking system unmounts and degrading filesystem cache effectiveness.
Technical details
The vulnerability is a resource leak in the nfsd_cross_mnt() function in fs/nfsd/vfs.c. The function acquires mount and dentry references via mntget() and dget() before calling follow_down(). When follow_down() returns an error, the code jumps to the exit label without calling path_put() to release these references, unlike all other exit paths in the function. This causes mnt_count and d_count to increase unboundedly on each failed cross-mount operation. The vulnerability is reachable by any authenticated NFS client through nfsd_lookup_dentry() or the NFSv4 READDIR encode path, requiring only valid NFS credentials. The fix adds a path_put() call in the error path before the goto statement.
Affected products
- Linux Linux kernel multiple versions (patched in 6.14 and stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89707 published
- 2026-05-31: patched: Fix committed upstream (commit 6cba08dc1922140d260cfeb30bbda4ee1bf869d8)