UBUNTU-CVE-2026-89715: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile() races with nfsuuidput() tearing down uuid->net, it returns -ENXIO without publishing nfl->nfsuuid via rcuassignpointer(). nfsopenlocalfh() then enters its error branch and only releases the slot's file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op: nfscloselocalfh() nfsuuid = rcudereference(nfl->nfsuuid); if (!nfsuuid) { rcureadunlock(); return; } / always / nfsdopenlocalfh() returns localio holding a caller-owned +1 nfsdfile reference (from nfsdfileget() after nfsdfileacquirelocal()) and an entry-time nfsdnet reference (from its first nfsdnettryget()) embedded as nf->nfnet. Both are leaked on the failure path, pinning one nfsdfile (and the underlying struct file, dentry, inode) and one nfsdnetref per occurrence, which blocks nfsdnet and netns teardown. Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared: struct nfsdfile rcu tmp = RCUINITIALIZER(localio); nfstonfsdfileputlocal(pnf); nfstonfsdfileputlocal(&tmp); localio = ERRPTR(-ENXIO); The trailing nfstonfsdnetput(net) continues to release the outer net ref, so all three nfsdnettryget() increments are balanced on the error branch.