Cloudanix VulnDB

CVE-2026-89680

High · 7.5

CVSS

7.5

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux file-copy handling for network servers can let repeated failed copy attempts slowly use up memory until the server stops responding.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure path in nfsd4_copy bypasses release_copy_files, leaking one nfsd_file reference and pinning the associated file, inode, dentry and vfsmount on every unsuccessful inter-server COPY setup.

Why it matters to the business

Repeated failed COPY operations slowly exhaust kernel memory and pin filesystem objects on NFS servers, eventually causing denial of service and degraded file-serving capacity.

How an attack unfolds

An attacker repeatedly issues inter-server COPY requests that trigger nfsd4_setup_inter_ssc failure; the kernel returns nfserr_offload_denied without releasing the nfsd_file reference taken earlier, accumulating leaks until memory pressure or pinned objects impair the server.

How to fix it

Apply the upstream kernel patch that sets status and jumps to the out: label in nfsd4_copy, or upgrade to a kernel release containing the fix for this leak.

How to confirm the fix worked

Confirm the patched code path is present by inspecting fs/nfsd/nfs4proc.c around nfsd4_copy and nfsd4_setup_inter_ssc; monitor nfsd_file reference counts under load with failing COPY attempts.

Typical attack path

  1. Establish an NFSv4.2 mount to a target server configured for inter-server copy
  2. Craft and send COPY operations that cause nfsd4_setup_inter_ssc to fail
  3. Observe direct return of nfserr_offload_denied bypassing the cleanup label
  4. Repeat until kernel memory or pinned filesystem objects are exhausted

How to detect it

Review kernel logs for repeated nfsd COPY failures; watch for steadily increasing nfsd_file or dentry counts without corresponding file closes; correlate with NFSv4.2 inter-server copy traffic.

What your security team should do

  • Prioritize kernel updates for all NFSv4.2 servers that enable inter-server copy
  • Disable or restrict inter-server COPY if the feature is not required
  • Add kernel memory and nfsd_file leak monitoring to existing observability

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY setup failure When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the out: label where release_copy_files() would drop the nf_dst reference taken by nfs4_preprocess_stateid_op(). Each failed inter-server COPY leaks one nfsd_file, pinning file/inode/dentry/vfsmount. Fix by setting status and jumping to out: instead of returning directly.

Affected packages

Ecosystem Package Introduced Fixed