GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89707 (GCVE-0-2026-89707)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
nfsd: release path refs on follow_down() error
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references: err = follow_down(&path, follow_flags); if (err < 0) goto out; follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cc53ce53c86924bfe98a12ea20b7465038a08792 , < 085cfde7c2186acaad103f02d2c25435ad5224e9 (git)
Affected: cc53ce53c86924bfe98a12ea20b7465038a08792 , < 194316df81263519156ebe714c4a286bee00e5be (git)
Affected: cc53ce53c86924bfe98a12ea20b7465038a08792 , < 467d56fd3ff57447a790c6dc3ede2d02a947d224 (git)
Affected: cc53ce53c86924bfe98a12ea20b7465038a08792 , < 2bc4343308d85ee4e0dd3877b384306c96f114c2 (git)
Affected: cc53ce53c86924bfe98a12ea20b7465038a08792 , < 6cba08dc1922140d260cfeb30bbda4ee1bf869d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "085cfde7c2186acaad103f02d2c25435ad5224e9",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "194316df81263519156ebe714c4a286bee00e5be",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "467d56fd3ff57447a790c6dc3ede2d02a947d224",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "2bc4343308d85ee4e0dd3877b384306c96f114c2",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "6cba08dc1922140d260cfeb30bbda4ee1bf869d8",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release path refs on follow_down() error\n\nnfsd_cross_mnt() initializes a local struct path with mntget() and\ndget() before calling follow_down(). On a negative return the error\narm jumps to out without releasing those references:\n\n    err = follow_down(\u0026path, follow_flags);\n    if (err \u003c 0)\n            goto out;\n\nfollow_down() never drops the caller\u0027s entry-time refs on any error\nsub-case; for example a pre-cross d_manage() failure leaves path\nuntouched, so the mntget()/dget() taken on entry survive the call.\n\nEvery other early-exit arm in nfsd_cross_mnt() (other-namespace\nreturn, IS_ERR(exp2), and the success tail after the swap) already\ncalls path_put(\u0026path); the err \u003c 0 arm is the lone omission. The\nleak inflates mnt_count and d_count on each failed cross-mount,\nblocking umount and pinning dentries against the shrinker, and is\nreachable by any authenticated NFS client through nfsd_lookup_dentry\nor the NFSv4 READDIR encode path.\n\nFix by calling path_put(\u0026path) before the goto out in the err \u003c 0\narm so the entry-time refs are released on all follow_down() error\nreturns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_cross_mnt() runs in the in-kernel NFS server on TCP/UDP 2049 from nfsd_lookup_dentry() (NFSv2/v3/v4 LOOKUP) and nfsd4_encode_entry4_fattr() (NFSv4 READDIR); a remote client reaches it with ordinary RPC requests.\nAC:L - On a typical nfsd export of autofs homes or nested mounts with crossmnt, an attacker can deterministically make follow_down() fail (autofs d_manage/automount error) by repeating LOOKUP/READDIR of failing mount triggers; no race or victim-controlled layout is required.\nPR:N - Default nfsd exports accept RPC_AUTH_NULL and RPC_AUTH_UNIX with no password; fh_verify only checks export IP policy, a MOUNT/PUTROOTFH filehandle, and directory execute, so no Linux account or capability on the server is required.\nUI:N - The attacker triggers the leak with their own NFS LOOKUP or READDIR RPCs; no victim mount, click, or other interactive action is required.\nS:U - The leak inflates dentry and vfsmount refcounts inside the nfsd host kernel and does not cross a VM, IOMMU, or other separate security authority.\nC:N - The bug only fails to path_put() the mntget/dget taken before follow_down(); it does not read kernel or file data or provide an information-disclosure primitive.\nI:N - The bug does not write attacker-controlled data or corrupt kernel objects; it only retains extra references on existing dentries and mounts.\nA:H - Each failed follow_down() permanently pins the dentry and vfsmount; repeated LOOKUPs of distinct autofs/mountpoint names leave unreclaimable dentries, block umount, and can exhaust kernel memory for a system-wide DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:08.548Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/085cfde7c2186acaad103f02d2c25435ad5224e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/194316df81263519156ebe714c4a286bee00e5be"
        },
        {
          "url": "https://git.kernel.org/stable/c/467d56fd3ff57447a790c6dc3ede2d02a947d224"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bc4343308d85ee4e0dd3877b384306c96f114c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cba08dc1922140d260cfeb30bbda4ee1bf869d8"
        }
      ],
      "title": "nfsd: release path refs on follow_down() error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89707",
    "datePublished": "2026-09-11T19:46:23.293Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-09-14T12:02:08.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89707",
      "date": "2026-09-16",
      "epss": "0.00603",
      "percentile": "0.47271"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89707\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:58.017\",\"lastModified\":\"2026-09-14T13:19:20.690\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: release path refs on follow_down() error\\n\\nnfsd_cross_mnt() initializes a local struct path with mntget() and\\ndget() before calling follow_down(). On a negative return the error\\narm jumps to out without releasing those references:\\n\\n    err = follow_down(\u0026path, follow_flags);\\n    if (err \u003c 0)\\n            goto out;\\n\\nfollow_down() never drops the caller\u0027s entry-time refs on any error\\nsub-case; for example a pre-cross d_manage() failure leaves path\\nuntouched, so the mntget()/dget() taken on entry survive the call.\\n\\nEvery other early-exit arm in nfsd_cross_mnt() (other-namespace\\nreturn, IS_ERR(exp2), and the success tail after the swap) already\\ncalls path_put(\u0026path); the err \u003c 0 arm is the lone omission. The\\nleak inflates mnt_count and d_count on each failed cross-mount,\\nblocking umount and pinning dentries against the shrinker, and is\\nreachable by any authenticated NFS client through nfsd_lookup_dentry\\nor the NFSv4 READDIR encode path.\\n\\nFix by calling path_put(\u0026path) before the goto out in the err \u003c 0\\narm so the entry-time refs are released on all follow_down() error\\nreturns.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cc53ce53c86924bfe98a12ea20b7465038a08792\",\"lessThan\":\"085cfde7c2186acaad103f02d2c25435ad5224e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc53ce53c86924bfe98a12ea20b7465038a08792\",\"lessThan\":\"194316df81263519156ebe714c4a286bee00e5be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc53ce53c86924bfe98a12ea20b7465038a08792\",\"lessThan\":\"467d56fd3ff57447a790c6dc3ede2d02a947d224\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc53ce53c86924bfe98a12ea20b7465038a08792\",\"lessThan\":\"2bc4343308d85ee4e0dd3877b384306c96f114c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc53ce53c86924bfe98a12ea20b7465038a08792\",\"lessThan\":\"6cba08dc1922140d260cfeb30bbda4ee1bf869d8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/085cfde7c2186acaad103f02d2c25435ad5224e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/194316df81263519156ebe714c4a286bee00e5be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2bc4343308d85ee4e0dd3877b384306c96f114c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/467d56fd3ff57447a790c6dc3ede2d02a947d224\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cba08dc1922140d260cfeb30bbda4ee1bf869d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:46:55+00:00",
      "cve": "CVE-2026-89707",
      "id": "CVE-2026-89707",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: release path refs on follow_down() error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89707.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T23:59:44Z",
      "cve": "CVE-2026-89707",
      "id": "CVE-2026-89707",
      "initial_release_date": "2026-09-15T23:59:44Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89707",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89707.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.