CVE-2026-23297 Overview
CVE-2026-23297 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the nfsd_nl_threads_set_doit() function, which leaks struct cred references each time it is invoked. The function calls get_current_cred() and passes the resulting credential down to nfsd_svc() and ultimately _svc_xprt_create(), but the original reference taken by get_current_cred() is never released with put_cred(). The leak was discovered by syzbot through kernel memory leak instrumentation. Each invocation consumes 184 bytes of slab memory that is never reclaimed.
Critical Impact
Repeated invocation of the affected netlink path can exhaust kernel slab memory, degrading host stability over time on systems running NFS server workloads.
Affected Products
- Linux kernel versions containing the nfsd_nl_threads_set_doit() netlink handler
- NFS server deployments using netlink-based thread configuration
- Distributions shipping affected upstream stable kernels prior to the fix commits
Discovery Timeline
- 2026-03-25 - CVE-2026-23297 published to the National Vulnerability Database
- 2026-03-25 - Last updated in NVD database
Technical Details for CVE-2026-23297
Vulnerability Analysis
The vulnerability is a credential reference leak [CWE-401] in the Linux kernel NFS server netlink interface. The nfsd_nl_threads_set_doit() handler is invoked when userspace sends a netlink message via sendmsg() to configure NFS server threads. Inside this handler, get_current_cred() increments the refcount on the calling task's credentials and passes the pointer to nfsd_svc(). The credential then flows into _svc_xprt_create(), which calls get_cred() again to take its own reference for the struct svc_xprt it creates. The reference acquired by the outer get_current_cred() is never balanced with a put_cred() call, leaving an orphaned refcount each time the path executes.
The fix replaces get_current_cred() with current_cred(), which returns the credential pointer without bumping the refcount. Because nfsd_nl_threads_set_doit() runs in the syscall context of sendmsg(), current->cred is guaranteed to remain valid for the duration of the call, making the extra reference unnecessary.
Root Cause
The root cause is an unbalanced refcount acquisition. get_current_cred() transfers ownership of a new reference to the caller, but the caller in this code path never releases it. The downstream consumer takes its own reference rather than adopting the one passed in, so the original reference is leaked.
Attack Vector
A local user able to send netlink messages to the nfsd family can repeatedly trigger the leak by invoking the thread configuration operation. Each call leaks one struct cred allocation. Sustained invocation increases kernel memory pressure and can lead to resource exhaustion on long-running systems.
No synthetic exploitation code is provided. Refer to the upstream commits listed in the references for the precise patch hunks.
Detection Methods for CVE-2026-23297
Indicators of Compromise
- Growing cred_jar slab cache size in /proc/slabinfo without a corresponding increase in active processes
- Kernel kmemleak reports referencing prepare_creds+0x22/0x600 in the allocation backtrace
- Repeated netlink sendmsg() activity targeting the nfsd generic netlink family from local processes
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test kernels and inspect /sys/kernel/debug/kmemleak for credential allocations attributed to nfsd netlink handlers
- Monitor slab statistics for unbounded growth in the cred_jar cache on hosts running nfsd
- Audit netlink traffic to the nfsd family using auditd rules on the sendmsg syscall filtered by socket family
Monitoring Recommendations
- Track kernel memory consumption trends on NFS server hosts and alert on sustained growth that does not correlate with workload
- Correlate process accounting data with NFS server thread configuration changes to identify abusive callers
- Collect kernel logs and kmemleak output centrally for review when memory pressure events occur
How to Mitigate CVE-2026-23297
Immediate Actions Required
- Apply the upstream stable kernel update containing the fix commits referenced below
- Restrict access to the nfsd generic netlink family to trusted administrative users only
- Reboot affected hosts after patching to clear any accumulated leaked credentials
Patch Information
The fix replaces the get_current_cred() call in nfsd_nl_threads_set_doit() with current_cred() so no extra reference is taken. The change has been merged into the stable trees through commits 1cb968a, 27c13c5b, 41170716, and a3f88e3e.
Workarounds
- Avoid using netlink-based NFS thread configuration on unpatched kernels; use the /proc/fs/nfsd/threads interface (write_threads()), which is not affected
- Limit CAP_NET_ADMIN and netlink socket access to trusted accounts to reduce exposure
- Schedule periodic reboots of long-running NFS servers until the patch is applied to reclaim leaked memory
# Verify running kernel against fixed stable releases
uname -r
# Restrict access to NFS thread management via the legacy procfs interface
ls -l /proc/fs/nfsd/threads
chmod 600 /proc/fs/nfsd/threads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
