Cloudanix VulnDB

CVE-2026-89683

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing service can slowly leak memory when handling certain requests, eventually making the server run out of resources.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

nfsd_set_fh_dentry leaks the dentry reference returned by exportfs_decode_fh_raw when NFSEXP_V4ROOT is detected in the NFS3_FHSIZE or NFS_FHSIZE cases; the out label performs exp_put but omits dput and never assigns fhp->fh_dentry so fh_put cannot release it.

Why it matters to the business

Sustained crafted requests against V4ROOT exports gradually exhaust kernel memory on NFS servers, risking service degradation or denial of service for file-sharing workloads.

How an attack unfolds

An attacker repeatedly transmits a crafted NFSv3 filehandle whose fsid matches a V4ROOT export; each request follows the leaking code path, accumulating unreleased dentry references until memory pressure affects the server.

How to fix it

Apply the upstream kernel commit that adds the missing dput(dentry) call before the out label in nfsd_set_fh_dentry for V4ROOT handling.

How to confirm the fix worked

Inspect the nfsd source for the corrected nfsd_set_fh_dentry function ensuring dput is invoked on the early-out paths, then rebuild and deploy the patched kernel on affected NFS servers.

Typical attack path

  1. Identify an NFS server exporting a V4ROOT filesystem
  2. Craft an NFSv3 filehandle targeting the export's fsid
  3. Send the filehandle lookup request via NFSv3
  4. Repeat the request at volume to accelerate the leak

How to detect it

Correlate high-volume NFSv3 filehandle lookup requests against V4ROOT exports with rising dentry and slab memory counters in kernel memory statistics.

What your security team should do

  • Patch NFS servers running the vulnerable kernel as soon as a fixed build is available
  • Restrict NFSv3 access to V4ROOT exports to trusted clients until patched
  • Monitor kernel memory and dentry cache usage on exposed NFS servers for anomalous growth

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_fh_dentry() leaks the dentry reference from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and goto out. The out: label calls exp_put() but never dput(dentry), and fhp->fh_dentry was never assigned so fh_put() cannot compensate. A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request.

Affected packages

Ecosystem Package Introduced Fixed