Cloudanix VulnDB

CVE-2026-89715

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in NFS file handling can leak internal resources during certain operations, making it harder for the system to cleanly shut down network connections.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race between nfs_uuid_add_file and nfs_uuid_put on uuid->net teardown returns -ENXIO without publishing the pointer; the error path in nfs_open_local_fh and callers leaks the caller-owned nfsd_file reference plus an nfsd_net reference, pinning the underlying file/dentry/inode and blocking nfsd_net/netns teardown.

Why it matters to the business

Repeated triggering of the race can exhaust limited kernel resources and prevent clean shutdown or migration of network namespaces in NFS environments, leading to operational disruption and potential need for reboots.

How an attack unfolds

An attacker with local access triggers concurrent NFS localio operations that race the uuid add and put paths; the resulting error branch leaks references without cleanup, accumulating pinned objects that block netns teardown.

How to fix it

Apply the upstream fix that uses a stack-local RCU pointer and calls nfs_to_nfsd_file_put_local on both the file and tmp references before returning -ENXIO, ensuring all three nfsd_net_try_get increments are balanced.

How to confirm the fix worked

Confirm the patched code path contains the RCU-initialized tmp variable and the two nfs_to_nfsd_file_put_local calls on the error branch; monitor for absence of reference-count warnings during concurrent localio and netns teardown tests.

Typical attack path

  1. Obtain local execution on an NFS client or server using localio.
  2. Issue concurrent nfs_open_local_fh / nfs_close_local_fh sequences that collide with uuid teardown.
  3. Observe accumulated leaked nfsd_file and nfsd_net references that survive until reboot.
  4. Trigger netns deletion or container shutdown to surface the teardown blockage.

How to detect it

Review kernel logs for reference-count imbalance warnings or netns teardown stalls during NFS localio activity; inspect nfsd_file and nfsd_net reference counters via debugfs or crash dumps for unexpected retention after close operations.

What your security team should do

  • Prioritize kernel upgrade to a version containing the reference-release fix on the error path.
  • Limit exposure by restricting untrusted local code execution on systems that enable NFS localio.
  • Add monitoring for reference-count imbalance or netns teardown stalls in production kernels.

The record

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via rcu_assign_pointer(). nfs_open_local_fh() then enters its error branch and only releases the slot's file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op: nfs_close_local_fh() nfs_uuid = rcu_dereference(nfl->nfs_uuid); if (!nfs_uuid) { rcu_read_unlock(); return; } /* always */ nfsd_open_local_fh() returns localio holding a caller-owned +1 nfsd_file reference (from nfsd_file_get() after nfsd_file_acquire_local()) and an entry-time nfsd_net reference (from its first nfsd_net_try_get()) embedded as nf->nf_net. Both are leaked on the failure path, pinning one nfsd_file (and the underlying struct file, dentry, inode) and one nfsd_net_ref per occurrence, which blocks nfsd_net and netns teardown. Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared: struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio); nfs_to_nfsd_file_put_local(pnf); nfs_to_nfsd_file_put_local(&tmp); localio = ERR_PTR(-ENXIO); The trailing nfs_to_nfsd_net_put(net) continues to release the outer net ref, so all three nfsd_net_try_get() increments are balanced on the error branch.

Affected packages

Ecosystem Package Introduced Fixed