CVE-2026-89707nfsd: release path refs on follow_down() error
- 7.5HighCVSS base score
- 0.70%Exploitation in 30 daysEPSS · top 46% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references: err = follow_down(&path, follow_flags); if (err < 0) goto out; follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns.
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.70% · top 46% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < bdf5a0f88d21239d8f9f7519b87359ba95fd045c
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 18847cbf5900f5c6c55bef5a6f7a34a1918d1181
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < e301c5cdb0dc2c4aeffc0c055ea15615d9c51fdc
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 085cfde7c2186acaad103f02d2c25435ad5224e9
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 194316df81263519156ebe714c4a286bee00e5be
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 467d56fd3ff57447a790c6dc3ede2d02a947d224
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 2bc4343308d85ee4e0dd3877b384306c96f114c2
- affected cc53ce53c86924bfe98a12ea20b7465038a08792 – < 6cba08dc1922140d260cfeb30bbda4ee1bf869d8
- affected 2.6.38
- unaffected < 2.6.38
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/bdf5a0f88d21239d8f9f7519b87359ba95fd045c (opens in a new tab)
- https://git.kernel.org/stable/c/18847cbf5900f5c6c55bef5a6f7a34a1918d1181 (opens in a new tab)
- https://git.kernel.org/stable/c/e301c5cdb0dc2c4aeffc0c055ea15615d9c51fdc (opens in a new tab)
- https://git.kernel.org/stable/c/085cfde7c2186acaad103f02d2c25435ad5224e9 (opens in a new tab)
- https://git.kernel.org/stable/c/194316df81263519156ebe714c4a286bee00e5be (opens in a new tab)
- https://git.kernel.org/stable/c/467d56fd3ff57447a790c6dc3ede2d02a947d224 (opens in a new tab)
- https://git.kernel.org/stable/c/2bc4343308d85ee4e0dd3877b384306c96f114c2 (opens in a new tab)
- https://git.kernel.org/stable/c/6cba08dc1922140d260cfeb30bbda4ee1bf869d8 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76619 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89707)Record last updated .