CVE-2026-89683 - Vulnerability Details

- nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

nfsd_set_fh_dentry() leaks the dentry reference from
exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE
switch cases detect NFSEXP_V4ROOT and goto out. The out: label
calls exp_put() but never dput(dentry), and fhp->fh_dentry was
never assigned so fh_put() cannot compensate.

A crafted NFSv3 filehandle targeting a V4ROOT export's fsid
triggers the leak on every request.

Published: 2026-09-11

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in nfsd_set_fh_dentry, which inadvertently retains a dentry reference when processing an NFSv3 filehandle that references a V4ROOT export. This leaks kernel memory for every request. The weakness is recognized as a resource leak, aligning with CWE-911.

Affected Systems

The flaw is present in the Linux kernel’s NFS daemon, so any Linux machine running a kernel build before the patch is at risk. No specific kernel version range is supplied; therefore all exposed Linux installations are potentially vulnerable. The patch targets the exportfs_decode_fh_raw and nfsd_set_fh_dentry code paths used for NFSv3 filehandle processing.

Risk and Exploitability

The CVSS score is 5.9, and the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known large‑scale campaigns. Based on the description, it is inferred that an attacker could craft an NFSv3 filehandle targeting a V4ROOT export's fsid; a remote client would then repeatedly invoke lookups that trigger the leak.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444`	affected	< d493cf57f4c4dae5396cd6ad41e5c209d0615a81
`ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444`	affected	< c1ae0f973bcba5730871e35976a0ab6878fdac34
`ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444`	affected	< 11db8df188b34bdb8c6a3a0bf438e5fc8cd75aca
`ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444`	affected	< 6247023fbbec1325029f2d5f2a7cdc0f9f9ea15a

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444,d493cf57f4c4dae5396cd6ad41e5c209d0615a81)`	affected	code_commit	—
`[ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444,c1ae0f973bcba5730871e35976a0ab6878fdac34)`	affected	code_commit	—
`[ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444,11db8df188b34bdb8c6a3a0bf438e5fc8cd75aca)`	affected	code_commit	—
`[ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444,6247023fbbec1325029f2d5f2a7cdc0f9f9ea15a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	generic	—
`[0,6.12)`	unaffected	semver	—
`[6.12.109,7.0.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official kernel patch to update the Linux kernel to a version that includes the NFSd fix.
Disable or restrict NFSv3 export access to V4ROOT exports so the vulnerable code path cannot be exercised.
Monitor system memory usage for signs of sustained leaks and isolate NFS services within a protected network segment.

Generated by OpenCVE AI on September 15, 2026 at 20:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/11db8df188b34bdb8c6a3a0bf438e5fc8cd75aca
https://git.kernel.org/stable/c/6247023fbbec1325029f2d5f2a7cdc0f9f9ea15a
https://git.kernel.org/stable/c/c1ae0f973bcba5730871e35976a0ab6878fdac34
https://git.kernel.org/stable/c/d493cf57f4c4dae5396cd6ad41e5c209d0615a81
https://nvd.nist.gov/vuln/detail/CVE-2026-89683
https://www.cve.org/CVERecord?id=CVE-2026-89683

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89683 https://www.cve.org/CVERecord?id=CVE-2026-89683
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_fh_dentry() leaks the dentry reference from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and goto out. The out: label calls exp_put() but never dput(dentry), and fhp->fh_dentry was never assigned so fh_put() cannot compensate. A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request.
Title		nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/11db8df188b34bdb8c6a3a0bf438e5fc8cd75aca https://git.kernel.org/stable/c/6247023fbbec1325029f2d5f2a7cdc0f9f9ea15a https://git.kernel.org/stable/c/c1ae0f973bcba5730871e35976a0ab6878fdac34 https://git.kernel.org/stable/c/d493cf57f4c4dae5396cd6ad41e5c209d0615a81

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:05.635Z

Updated: 2026-09-11T19:46:05.635Z

Reserved: 2026-09-11T19:38:34.748Z

Link: CVE-2026-89683

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:55.173

Modified: 2026-09-11T20:19:55.173

Link: CVE-2026-89683

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:05Z

Links: CVE-2026-89683 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:45:20Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object