CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
nfsdsetfhdentry() leaks the dentry reference from exportfsdecodefhraw() when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls expput() but never dput(dentry), and fhp->fhdentry was never assigned so fhput() cannot compensate.
A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel NFS server are exposed when they have a V4ROOT export and accept NFSv3 filehandle lookups. The issue is triggered by requests targeting that export's fsid.
What does an attacker need to do to trigger the leak?
An attacker needs to send crafted NFSv3 filehandles targeting the fsid of a V4ROOT export. Each such request triggers another leaked dentry reference.
Are ordinary requests sufficient to cause the problem?
The described trigger requires a crafted NFSv3 filehandle rather than an ordinary valid lookup. The affected path is specifically the NFS3_FHSIZE or NFS_FHSIZE handling for an export marked NFSEXP_V4ROOT.
How can I tell whether exploitation attempts may be occurring?
The provided information does not identify a specific log entry or detection signature. Repeated crafted NFSv3 requests against a V4ROOT export's fsid would cause dentry references to accumulate.