CVE-2026-89715

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: fix ref leak on nfs_uuid_add_file failure

When nfs_uuid_add_file() races with nfs_uuid_put() tearing down

uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via

rcu_assign_pointer(). nfs_open_local_fh() then enters its error

branch and only releases the slot's file ref and its paired net

ref plus its own entry-time net ref, while the close path is a

no-op:

nfs_close_local_fh()

nfs_uuid = rcu_dereference(nfl->nfs_uuid);

if (!nfs_uuid) { rcu_read_unlock(); return; } /* always */

nfsd_open_local_fh() returns localio holding a caller-owned +1

nfsd_file reference (from nfsd_file_get() after

nfsd_file_acquire_local()) and an entry-time nfsd_net reference

(from its first nfsd_net_try_get()) embedded as nf->nf_net. Both

are leaked on the failure path, pinning one nfsd_file (and the

underlying struct file, dentry, inode) and one nfsd_net_ref per

occurrence, which blocks nfsd_net an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References