NFS/localio: fix ref leak on nfs_uuid_add_file failure
Summary
| CVE | CVE-2026-89715 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-11 20:19:58 UTC |
|---|
| Updated | 2026-09-11 20:19:58 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
NFS/localio: fix ref leak on nfs_uuid_add_file failure
When nfs_uuid_add_file() races with nfs_uuid_put() tearing down
uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via
rcu_assign_pointer(). nfs_open_local_fh() then enters its error
branch and only releases the slot's file ref and its paired net
ref plus its own entry-time net ref, while the close path is a
no-op:
nfs_close_local_fh()
nfs_uuid = rcu_dereference(nfl->nfs_uuid);
if (!nfs_uuid) { rcu_read_unlock(); return; } /* always */
nfsd_open_local_fh() returns localio holding a caller-owned +1
nfsd_file reference (from nfsd_file_get() after
nfsd_file_acquire_local()) and an entry-time nfsd_net reference
(from its first nfsd_net_try_get()) embedded as nf->nf_net. Both
are leaked on the failure path, pinning one nfsd_file (and the
underlying struct file, dentry, inode) and one nfsd_net_ref per
occurrence, which blocks nfsd_net and netns teardown.
Fix by releasing the caller-owned file ref and its net ref through
the existing helper, using a stack-local RCU pointer so the helper
can xchg it out, then returning -ENXIO so callers do not
dereference a localio whose slot has been cleared:
struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);
nfs_to_nfsd_file_put_local(pnf);
nfs_to_nfsd_file_put_local(&tmp);
localio = ERR_PTR(-ENXIO);
The trailing nfs_to_nfsd_net_put(net) continues to release the
outer net ref, so all three nfsd_net_try_get() increments are
balanced on the error branch. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected fdd015de767977f21892329af5e12276eb80375f 5215e734bf7cba18237155f8cb2a0accb60ca339 git |
Not specified |
| CNA |
Linux |
Linux |
affected fdd015de767977f21892329af5e12276eb80375f 9f59b05423ed381f8cdeaaae4bd6778adcb6865c git |
Not specified |
| CNA |
Linux |
Linux |
affected fdd015de767977f21892329af5e12276eb80375f ca018c19e0ba38975e5ddc3ef8117d5b734313aa git |
Not specified |
| CNA |
Linux |
Linux |
affected 55735dc5a0ee0c0fc14cb51e005eae862906a410 git |
Not specified |
| CNA |
Linux |
Linux |
affected 7cac8a129fc53497f9ee5d66fca55a245d009b97 git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.15.10 6.16 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.16.1 6.17 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.17 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.17 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.50 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.4 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/5215e734bf7cba18237155f8cb2a0accb60ca339 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/ca018c19e0ba38975e5ddc3ef8117d5b734313aa |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9f59b05423ed381f8cdeaaae4bd6778adcb6865c |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.