CVE-2026-89707

A flaw was found in the Linux kernel's nfsd component. An authenticated Network File System (NFS) client can exploit this vulnerability by triggering a failed cross-mount operation through nfsd_lookup_dentry or the NFSv4 READDIR encode path. This leads to a reference count leak, which inflates mnt_count and d_count, blocking unmounting operations and pinning directory entries against the shrinker. This can result in a Denial of Service (DoS) condition.

nfsd_cross_mnt can leak VFS path references when follow_down returns an error after mntget and dget have already taken entry time references. An authenticated remote NFS client may be able to trigger the affected path through lookup or NFSv4 READDIR processing when an exported tree uses cross mount or automount behavior and follow_down fails. For the CVSS the PR:L is used because the attacker needs authenticated client access to the NFS export rather than local administrator privileges. The issue is network reachable through NFS service operations, but it is configuration dependent and requires a failing cross mount traversal path. Impact is denial of service through resource exhaustion, pinned dentries, increased mount reference counts, and blocked umount operations. No confidentiality or integrity impact is assigned because the primitive is a reference leak rather than memory corruption or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.