CVE-2026-89707

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release path refs on follow_down() error

nfsd_cross_mnt() initializes a local struct path with mntget() and

dget() before calling follow_down(). On a negative return the error

arm jumps to out without releasing those references:

err = follow_down(&path, follow_flags);

if (err < 0)

goto out;

follow_down() never drops the caller's entry-time refs on any error

sub-case; for example a pre-cross d_manage() failure leaves path

untouched, so the mntget()/dget() taken on entry survive the call.

Every other early-exit arm in nfsd_cross_mnt() (other-namespace

return, IS_ERR(exp2), and the success tail after the swap) already

calls path_put(&path); the err < 0 arm is the lone omission. The

leak inflates mnt_count and d_count on each failed cross-mount,

blocking umount and pinning dentries against the shrinker, and is

reachable by any authenticated NFS client through nfsd_lookup_dentry

or the NFSv4 R

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References