CVE-2026-89683

A flaw was found in the Linux kernel's nfsd (NFS daemon). A remote attacker could exploit this vulnerability by sending a specially crafted NFSv3 filehandle targeting a V4ROOT export's file system identifier (fsid). This action triggers a dentry reference leak, which can lead to resource exhaustion and ultimately result in a Denial of Service (DoS) on the affected system.

A dentry reference leak in nfsd_set_fh_dentry can occur when an NFSv3 filehandle lookup reaches a V4ROOT export path. The dentry reference returned by exportfs_decode_fh_raw is not released before the function exits through the V4ROOT out path, so each matching request can leak one reference. For the CVSS the PR:N is used because a remote NFS client generally does not need local privileges on the target host beyond network reachability to the NFS service. The issue is network reachable when nfsd and the affected export configuration are exposed to the attacker. Impact is primarily denial of service through sustained resource exhaustion, not a demonstrated information leak or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.