CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: fix ref leak on nfs uuid add file failure

When nfs uuid add file() races with nfs uuid put() tearing down uuid->net, it returns -ENXIO without publishing nfl->nfs uuid via rcu assign pointer(). nfs open local fh() then enters its error branch and only releases the slot's file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op:

nfs close local fh() nfs uuid = rcu dereference(nfl->nfs uuid); if (!nfs uuid) { rcu read unlock(); return; } /* always */

nfsd open local fh() returns localio holding a caller-owned +1 nfsd file reference (from nfsd file get() after nfsd file acquire local()) and an entry-time nfsd net reference (from its first nfsd net try get()) embedded as nf->nf net. Both are leaked on the failure path, pinning one nfsd file (and the underlying struct file, dentry, inode) and one nfsd net ref per occurrence, which blocks nfsd net and netns teardown.

Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared:

struct nfsd file rcu *tmp = RCU INITIALIZER(localio);

nfs to nfsd file put local(pnf); nfs to nfsd file put local(&tmp); localio = ERR PTR(-ENXIO);

The trailing nfs to nfsd net put(net) continues to release the outer net ref, so all three nfsd net try get() increments are balanced on the error branch.