CVE-2026-89707 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release path refs on follow_down() error
nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references:
err = follow_down(&path, follow_flags); if (err < 0) goto out;
follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call.
Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path.
Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel vulnerability identified as a reference leak within the Network File System daemon (nfsd) subsystem stems from an improper handling of resource cleanup during path traversal operations. Specifically, the function nfsd_cross_mnt is responsible for managing mount and dentry references when crossing between different filesystem namespaces or mounts. During its execution, this routine initializes a local struct path object by incrementing reference counts via mntget() and dget(). These calls are essential to ensure that the underlying mount point and directory entry remain valid while subsequent operations, such as follow_down(), determine if further traversal is possible. The core technical flaw lies in the error handling logic associated with the follow_down() call. When follow_down() returns a negative value indicating an error condition, the code path jumps directly to an exit label without invoking the necessary cleanup functions. This omission means that the reference counts incremented at the start of the function are never decremented, resulting in a persistent memory and resource leak every time this specific error branch is triggered.
The operational impact of this vulnerability extends beyond simple memory consumption, affecting system stability and availability for NFS clients. Because each failed cross-mount attempt leaves behind unreleased mount and dentry references, the mnt_count and d_count fields associated with those filesystem objects are artificially inflated over time. This accumulation has severe consequences for system administration tasks such as unmounting filesystems; since reference counts remain elevated due to leaked handles, the kernel prevents umount operations from completing, effectively locking resources in place. Furthermore, these pinned dentries cannot be reclaimed by the kernel's memory shrinker, leading to increased pressure on available memory and potentially contributing to resource exhaustion under sustained load. The vulnerability is particularly concerning because it is reachable through standard NFS client interactions, specifically via nfsd_lookup_dentry or during the encoding phase of an NFSv4 READDIR operation, meaning any authenticated user capable of triggering these specific lookup scenarios can contribute to this degradation.
From a classification perspective, this issue aligns with CWE-401, which describes missing release of memory after successful allocation, and more specifically relates to improper resource management in kernel space that leads to resource leaks. In the context of attack techniques, while not directly exploitable for code execution without further conditions, the ability to pin dentries and block umount operations contributes to Denial of Service scenarios by degrading system performance and preventing administrative recovery actions. The ATT&CK framework would categorize this under techniques that impact availability or resource exhaustion, although it is primarily a stability issue rather than an active exploitation vector for privilege escalation.
To mitigate this vulnerability, the kernel developers implemented a fix that ensures path_put(&path) is called before jumping to the error exit label in the err less than zero arm of nfsd_cross_mnt(). This change guarantees that entry-time references are properly released regardless of whether follow_down() succeeds or fails, bringing the error handling logic into consistency with other early-exit paths within the same function. System administrators should apply kernel updates that include this patch to prevent the gradual accumulation of leaked references. Regular monitoring of mount and dentry counts can help identify systems where such leaks might have already caused significant resource pinning before the fix was applied, requiring a reboot or manual intervention to clear stale entries if they persist after updating.