---
cve: "CVE-2026-89715"
severity: "LOW"
cvss: 3.1
epss: "20%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 19:46:29"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T04:18:05+02:00"
---

# CVE-2026-89715

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: fix ref leak on nfs_uuid_add_file failure

When nfs_uuid_add_file() races with nfs_uuid_put() tearing down
uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via
rcu_assign_pointer().  nfs_open_local_fh() then enters its error
branch and only releases the slot's file ref and its paired net
ref plus its own entry-time net ref, while the close path is a
no-op:

    nfs_close_local_fh()
      nfs_uuid = rcu_dereference(nfl->nfs_uuid);
      if (!nfs_uuid) { rcu_read_unlock(); return; }  /* always */

nfsd_open_local_fh() returns localio holding a caller-owned +1
nfsd_file reference (from nfsd_file_get() after
nfsd_file_acquire_local()) and an entry-time nfsd_net reference
(from its first nfsd_net_try_get()) embedded as nf->nf_net.  Both
are leaked on the failure path, pinning one nfsd_file (and the
underlying struct file, dentry, inode) and one nfsd_net_ref per
occurrence, which blocks nfsd_net and netns teardown.

Fix by releasing the caller-owned file ref and its net ref through
the existing helper, using a stack-local RCU pointer so the helper
can xchg it out, then returning -ENXIO so callers do not
dereference a localio whose slot has been cleared:

    struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);

    nfs_to_nfsd_file_put_local(pnf);
    nfs_to_nfsd_file_put_local(&tmp);
    localio = ERR_PTR(-ENXIO);

The trailing nfs_to_nfsd_net_put(net) continues to release the
outer net ref, so all three nfsd_net_try_get() increments are
balanced on the error branch.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## Referenzen

- <https://git.kernel.org/stable/c/5215e734bf7cba18237155f8cb2a0accb60ca339>
- <https://git.kernel.org/stable/c/9f59b05423ed381f8cdeaaae4bd6778adcb6865c>
- <https://git.kernel.org/stable/c/ca018c19e0ba38975e5ddc3ef8117d5b734313aa>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89715) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_