UBUNTU-CVE-2026-89707: High severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown() error nfsdcrossmnt() initializes a local struct path with mntget() and dget() before calling followdown(). On a negative return the error arm jumps to out without releasing those references: err = followdown(&path, followflags); if (err < 0) goto out; followdown() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross dmanage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsdcrossmnt() (other-namespace return, ISERR(exp2), and the success tail after the swap) already calls pathput(&path); the err < 0 arm is the lone omission. The leak inflates mntcount and dcount on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsdlookupdentry or the NFSv4 READDIR encode path. Fix by calling pathput(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all followdown() error returns.