CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix nfsdfile leak on inter-server COPY setup failure
When nfsd4setupinterssc() fails, nfsd4copy() returns nfserroffloaddenied directly, bypassing the out: label where releasecopyfiles() would drop the nfdst reference taken by nfs4preprocessstateidop(). Each failed inter-server COPY leaks one nfsdfile, pinning file/inode/dentry/vfsmount.
Fix by setting status and jumping to out: instead of returning directly.
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
An inter-server NFS COPY operation must reach nfsd4_setup_inter_ssc() and that setup must fail. Each such failure takes the direct error-return path that bypasses release_copy_files().
What is the impact of repeated failed requests?
Each failed inter-server COPY leaks one nfsd_file and pins its associated file, inode, dentry, and vfsmount references. Repeated failures can therefore accumulate unreleased kernel resources.
How can administrators tell whether a system is affected?
The described symptom is a growing number of unreleased nfsd_file-related references following failed inter-server COPY setup attempts. The issue occurs specifically when the setup failure path returns nfserr_offload_denied without reaching cleanup.