CVE-2026-43193 Overview
CVE-2026-43193 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the nfsd_get_dir_deleg() function, which fails to release a reference to the fp (nfs4_file) structure before returning. Each invocation of the affected code path leaks an nfs4_file reference, preventing the structure from being freed. Over time, repeated triggering of this path consumes kernel memory and can degrade NFS server stability. The issue was identified during code review, and a fix has been merged into the upstream Linux kernel stable trees.
Critical Impact
Repeated invocation of the affected NFS directory delegation path leaks nfs4_file references, causing kernel memory exhaustion on long-running NFS servers.
Affected Products
- Linux kernel versions containing the nfsd_get_dir_deleg() directory delegation logic
- Systems exporting NFSv4 shares with directory delegations enabled
- Distributions shipping affected stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-05-06 - CVE-2026-43193 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43193
Vulnerability Analysis
The vulnerability is a reference-counting bug in the Linux kernel NFS server. The function nfsd_get_dir_deleg() acquires a reference to an nfs4_file object through fp, but at least one return path exits without releasing that reference. The kernel's reference counting model requires every successful get to be paired with a matching put. When a put is missed, the object remains pinned in memory indefinitely. Because directory delegation requests originate from NFSv4 clients, an authenticated client interacting with the NFS server can repeatedly trigger the leak path. The kernel maintenance commit explicitly states the fix ensures fp is released before returning. The defect is classified as a kernel memory leak [CWE-401].
Root Cause
The root cause is an incomplete cleanup path in nfsd_get_dir_deleg(). The function obtains an nfs4_file reference but does not call the corresponding put_nfs4_file() on every exit branch. This violates the kernel's get/put symmetry requirement for refcounted objects.
Attack Vector
The leak is reachable through normal NFSv4 directory delegation traffic against an nfsd-exported filesystem. An NFS client repeatedly issuing operations that traverse the affected branch in nfsd_get_dir_deleg() causes monotonic growth of leaked nfs4_file allocations on the server. The result is kernel memory exhaustion and degraded service availability over time.
No public exploitation code is associated with this CVE. See the upstream commits for technical details: Kernel fix commit 0d8362e1 and Kernel fix commit 789477b8.
Detection Methods for CVE-2026-43193
Indicators of Compromise
- Steady growth of the nfsd4_files slab cache reported by /proc/slabinfo on NFS servers
- Increasing Slab and SUnreclaim counters in /proc/meminfo correlated with NFSv4 client activity
- Kernel out-of-memory (OOM) events on hosts running unpatched nfsd with directory delegations
Detection Strategies
- Compare the running kernel version against the fixed commits 0d8362e1 and 789477b8 to determine exposure
- Monitor slab allocator statistics for nfs4_file objects over multi-day windows to identify monotonic growth
- Audit NFS server uptime versus resident kernel memory to detect leak signatures
Monitoring Recommendations
- Collect /proc/slabinfo and /proc/meminfo metrics from all NFS servers and alert on unbounded slab growth
- Track nfsd thread memory consumption and NFSv4 operation counts in time-series telemetry
- Forward kernel ring buffer messages and OOM killer events to centralized logging for correlation
How to Mitigate CVE-2026-43193
Immediate Actions Required
- Apply the upstream stable kernel update containing commits 0d8362e15aad and 789477b84939 to all affected NFS servers
- Inventory hosts running nfsd with NFSv4 directory delegations enabled and prioritize them for patching
- Schedule rolling reboots after kernel package updates to reclaim already-leaked memory
Patch Information
The fix is merged in the Linux kernel stable tree. The patch ensures the fp reference acquired in nfsd_get_dir_deleg() is released on all return paths. Reference the upstream commit 0d8362e1 and upstream commit 789477b8 and consume the corresponding distribution kernel package once available.
Workarounds
- Disable NFSv4 directory delegations on affected servers until the patched kernel is deployed
- Restart nfsd or reboot servers periodically to bound the cumulative memory loss from the leak
- Restrict NFSv4 access to trusted client networks to limit the volume of operations that can trigger the leak path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
