CVE-2026-89707

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference leak occurs in the nfsd cross mnt() function when follow down() returns a negative value. The function initializes a local path structure using mntget() and dget(), but fails to call path put() before exiting on an error. This results in an increase of mnt count and d count during failed cross-mounts, which can block the umount process and prevent dentries from being reclaimed by the shrinker. This issue is reachable by authenticated NFS clients via nfsd lookup dentry or the NFSv4 READDIR encode path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.