CVE-2026-43394

What it actually does

Credential reference count leak in nfsd_nl_listener_set_doit() due to get_current_cred() without matching put_cred(), causing gradual resource exhaustion in process context.

Why it matters to the business

Linux systems running NFS servers may suffer progressive resource depletion leading to service instability or denial of service, requiring restarts and kernel updates to restore normal operations.

How an attack unfolds

A local attacker with privileges to invoke NFS netlink listener configuration repeatedly triggers the flawed handler, leaking credential references each time until system resources are exhausted.

How to fix it

Update to a Linux kernel containing the fix that replaces get_current_cred() with current_cred() in nfsd_nl_listener_set_doit(); apply available upstream patches or distribution updates addressing this leak.

How to confirm the fix worked

Inspect kernel source for nfsd_nl_listener_set_doit() to confirm current_cred() usage without unpaired get_current_cred(); perform load testing of NFS netlink listener operations while monitoring credential reference counts.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Acquire privileges sufficient to interact with nfsd netlink interfaces
3. Repeatedly call the listener set operation
4. Observe progressive credential or memory exhaustion

How to detect it

Review system and kernel logs for repeated nfsd netlink listener configuration calls; monitor credential reference counters or memory usage patterns during NFS administrative operations for anomalous growth.

What your security team should do

• Apply kernel updates addressing the credential leak as soon as available
• Restrict local access and netlink privileges on systems exposing nfsd
• Monitor kernel changelogs and distribution advisories for related fixes