CVE-2026-89707

The Linux kernel's NFS server contains a reference-count leak in nfsd_cross_mnt(): when follow_down() fails during a cross-mount traversal, the mntget()/dget() references taken on entry are never released because the error path skips path_put(). Any NFS client that can trigger a failed cross-mount lookup — for example a pre-cross d_manage() failure reached through nfsd_lookup_dentry or the NFSv4 READDIR encode path — causes the leak; the CVSS vector (AV:N/AC:L/PR:N) indicates no special privileges are needed beyond the ability to make NFS requests. Each failed attempt permanently increments mnt_count and d_count, pinning mounts so they cannot be unmounted and pinning dentries so the shrinker cannot reclaim them, eventually exhausting memory and degrading or halting the NFS service (availability impact only). Any machine running a kernel with the vulnerable nfsd code and actively exporting NFS filesystems — particularly exports that cross mount points — is affected. No public proof of concept is known and the issue is not in CISA's KEV, so exploitation is currently theoretical.

What to do: Apply kernel updates from your distribution as soon as a release containing the fix (the commit adding path_put(&path) before the goto out in the err < 0 arm of nfsd_cross_mnt()) is available. In the interim, restrict NFS exports and firewall port 2049 to trusted client networks only, and audit exports that use crossmnt or traverse mount points. On long-running NFS servers, watch for steadily growing mount/dentry reference counts or mounts that refuse to unmount, and plan a reboot to clear already-leaked references if symptoms appear.