CVE-2026-89715: NFS/localio: fix ref leak on nfs_uuid_add_file failure
In the Linux kernel, the following vulnerability has been resolved:
NFS/localio: fix ref leak on nfsuuidaddfile failure
When nfsuuidaddfile() races with nfsuuidput() tearing down uuid->net, it returns -ENXIO without publishing nfl->nfsuuid via rcuassignpointer(). nfsopenlocalfh() then enters its error branch and only releases the slot's file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op:
nfscloselocalfh() nfsuuid = rcudereference(nfl->nfsuuid); if (!nfsuuid) { rcureadunlock(); return; } / always /
nfsdopenlocalfh() returns localio holding a caller-owned +1 nfsdfile reference (from nfsdfileget() after nfsdfileacquirelocal()) and an entry-time nfsdnet reference (from its first nfsdnettryget()) embedded as nf->nfnet. Both are leaked on the failure path, pinning one nfsdfile (and the underlying struct file, dentry, inode) and one nfsdnetref per occurrence, which blocks nfsdnet and netns teardown.
Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared:
struct nfsdfile rcu tmp = RCUINITIALIZER(localio);
nfstonfsdfileputlocal(pnf); nfstonfsdfileputlocal(&tmp); localio = ERRPTR(-ENXIO);
The trailing nfstonfsdnetput(net) continues to release the outer net ref, so all three nfsdnettryget() increments are balanced on the error branch.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NFS/localio path are exposed when nfs_uuid_add_file() races with nfs_uuid_put() while uuid->net is being torn down. The issue occurs specifically when nfs_uuid_add_file() returns -ENXIO before nfl->nfs_uuid is published.
What is the operational impact of a successful trigger?
Each occurrence leaks an nfsd_file reference, including the underlying struct file, dentry, and inode, as well as an nfsd_net reference. These leaked references can prevent nfsd_net and network-namespace teardown.
How does the fix change failure handling?
On the affected -ENXIO failure path, the fix releases the caller-owned file reference and associated network reference through the existing helper before returning -ENXIO. This prevents the resources from remaining pinned when the close path has no published nfs_uuid to release.