HIGH Introduced in 6.12
nfsd V4Root Dentry Leak
CVE-2026-89683
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_fh_dentry() leaks the dentry reference from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and goto out. The out: label calls exp_put() but never dput(dentry), and fhp->fh_dentry was never assigned so fh_put() cannot compensate. A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request.
02KernelScan AI Analysis
Risk summary
An attacker who can send NFS requests to a server exporting a V4ROOT pseudofilesystem can trigger a dentry reference leak on every request by crafting a filehandle targeting the export's fsid. Repeated requests cause unbounded accumulation of leaked dentries, eventually exhausting kernel memory and degrading or crashing the system. No data corruption or disclosure occurs, but the vulnerability is a reliable network-reachable denial of service.
Vulnerability analysis
When the NFS server processes an incoming filehandle, it obtains a reference to a directory entry that must later be released. A special early-exit path for V4ROOT exports exits without releasing that reference, and because the filehandle was never fully set up, the normal cleanup path cannot compensate. A remote NFS client can trigger this leak on every request by sending a crafted filehandle targeting a V4ROOT export, causing unreleased directory entries to accumulate without bound and eventually exhausting kernel memory. The fix ensures the reference is properly released before each early exit. The vulnerability is reachable over the network by any client that can send NFS requests to the server; no local account or special privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12 | 6.12.109 | d493cf57f4c4 |
| 6.18 | 6.12 | 6.18.50 | c1ae0f973bcb |
| 7.2 | 6.12 | 7.2.4 | 11db8df188b3 |
| mainline | 6.12 | 7.3-rc1 | 6247023fbbec |
| cip/6.12 | 6.12 | 6.12.111-cip32 | d493cf57f4c4 |