CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release path refs on follow down() error

nfsd cross mnt() initializes a local struct path with mntget() and dget() before calling follow down(). On a negative return the error arm jumps to out without releasing those references:

err = follow down(&path, follow flags); if (err < 0) goto out;

follow down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call.

Every other early-exit arm in nfsd cross mnt() (other-namespace return, IS ERR(exp2), and the success tail after the swap) already calls path put(&path); the err < 0 arm is the lone omission. The leak inflates mnt count and d count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd lookup dentry or the NFSv4 READDIR encode path.

Fix by calling path put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow down() error returns.