CVE-2026-89680

The Linux kernel's NFS server (nfsd) contains a reference-counting leak in the NFSv4.2 server-side COPY path: when nfsd4_setup_inter_ssc() fails during an inter-server copy, nfsd4_copy() returns the nfserr_offload_denied error directly instead of jumping to its out: cleanup label, so the nfsd_file reference acquired by nfs4_preprocess_stateid_op() is never released. Each failed inter-server COPY request therefore leaks one nfsd_file, pinning the associated file, inode, dentry, and vfsmount in kernel memory. A remote NFS client that can reach the server and issue COPY operations can repeat failing inter-server copies to exhaust kernel memory, driving OOM kills or degraded/unavailable service, consistent with the CVSS 3.1 score of 7.5 (network vector, no privileges required, no user interaction, availability-only impact). Any Linux system running nfsd with NFSv4.2 inter-server copy support is affected, though the source data does not specify exact kernel version ranges. There is no known public PoC, the flaw is not in CISA's KEV catalog, and no exploitation has been observed.

What to do: Update to a distribution kernel carrying the upstream fix, which routes nfsd4_setup_inter_ssc() failures through the out: label so release_copy_files() drops the leaked reference — check your vendor's advisory for this CVE. Until patched, restrict NFS exports to trusted clients, keep TCP/2049 off untrusted networks, and consider disabling NFSv4.2 inter-server/server-side copy if not required. Watch for steady nfsd memory growth or rising pinned-file counts as an indicator that the leak is being triggered.