CVE-2026-89707
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux NFS server code can leak internal tracking data when certain file operations fail, eventually preventing the server from cleanly shutting down shared folders and causing availability problems for users.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Denial of service
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Reference count leak in nfsd_cross_mnt() where mntget()/dget() acquired before follow_down() are not released on negative return, leaving mnt_count and d_count inflated on every failed cross-mount attempt reachable via nfsd_lookup_dentry or NFSv4 READDIR.
Why it matters to the business
NFS servers can experience resource exhaustion that blocks filesystem unmounts and pins dentries, leading to service degradation or outages for file-sharing workloads; urgency is moderate given low EPSS and lack of known exploitation 43 days after publication.
How an attack unfolds
An authenticated NFS client repeatedly triggers cross-namespace lookups or directory reads that cause follow_down() to fail before d_manage or similar checks; each failure leaks references because the error path omits path_put, gradually exhausting mount and dentry counts until unmounts are blocked or memory pressure increases.
How to fix it
Apply the upstream kernel patch that inserts path_put(&path) before the goto out in the err < 0 arm of nfsd_cross_mnt(); rebuild and deploy the fixed kernel version to all affected NFS servers.
How to confirm the fix worked
Confirm the presence of the path_put call on the follow_down error path in the running kernel source or binary; verify that repeated failing cross-mount operations no longer increase mnt_count or d_count; test unmount behavior after simulated failures.
Typical attack path
- Establish authenticated NFS session to target server
- Issue lookup or READDIR operations that cross mount points and trigger follow_down failures
- Repeat failed cross-mount attempts to accumulate leaked references
- Observe blocked umount attempts or dentry shrinker pressure on the server
How to detect it
Review kernel logs and NFS server traces for repeated follow_down or cross-mount error returns; correlate with increasing mnt_count or d_count values via /proc or debugfs; look for authenticated client activity patterns that precede umount failures.
What your security team should do
- Patch NFS servers to the fixed kernel version at the next maintenance window
- Monitor mount and dentry reference counts on exposed NFS hosts
- Restrict NFS access to trusted clients until patches are applied
- Review logs for repeated cross-mount error patterns after deployment
The record
In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references: err = follow_down(&path, follow_flags); if (err < 0) goto out; follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|