CVE-2026-89680: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89680 Overview

CVE-2026-89680 is a resource leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the inter-server server-side copy (SSC) code path. When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly and bypasses the out: label. As a result, release_copy_files() never drops the nf_dst reference obtained by nfs4_preprocess_stateid_op(). Each failed inter-server COPY leaks one nfsd_file structure and pins the underlying file, inode, dentry, and vfsmount. Remote attackers can trigger the failure path repeatedly to exhaust kernel resources on the NFS server.

Critical Impact
Repeated failed inter-server NFSv4 COPY operations exhaust kernel memory and pin filesystem objects, producing a remote denial-of-service condition against affected NFS servers.

Affected Products

Linux kernel builds with CONFIG_NFSD enabled and inter-server SSC copy support
Linux distributions shipping vulnerable stable kernel branches referenced in the upstream fix commits
NFSv4.2 servers exposing inter-server COPY functionality to clients

Discovery Timeline

2026-09-11 - CVE-2026-89680 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89680

Vulnerability Analysis

The vulnerability is a memory leak (resource leak) in the Linux NFS server's handling of NFSv4.2 inter-server COPY operations. The NFS server uses nfsd_file objects to track open files, and each object pins a reference chain of file, inode, dentry, and vfsmount structures. Under normal completion, release_copy_files() releases these references on the copy source and destination.

When a client issues a COPY operation that requires inter-server setup, nfsd4_copy() first calls nfs4_preprocess_stateid_op() to acquire the destination nfsd_file reference (nf_dst). It then calls nfsd4_setup_inter_ssc() to establish the source-side context. If setup fails, the code path returns nfserr_offload_denied immediately instead of jumping to the out: label. The reference taken earlier is never released.

Each failed request leaks one nfsd_file along with the associated kernel objects. An unauthenticated or low-privileged NFS client that can reach the server over the network can loop failing COPY requests to progressively pin filesystem resources and consume kernel memory until the server degrades or fails.

Root Cause

The root cause is an early return that skips the function's cleanup epilogue. The correct pattern in nfsd4_copy() is to assign the error to status and goto out;, allowing release_copy_files() to drop nf_dst. Returning nfserr_offload_denied directly breaks that invariant and produces the leak on every failed inter-server COPY setup.

Attack Vector

Exploitation requires network access to an NFSv4.2 server that supports inter-server COPY. An attacker with an authenticated mount, or in permissive export configurations an unauthenticated client, repeatedly issues COPY operations crafted so that nfsd4_setup_inter_ssc() fails. Each failure permanently leaks kernel structures on the target server, ultimately producing resource exhaustion and denial of service without any user interaction on the server side.

No verified public exploit code is available. See the upstream commits for the exact code paths: Kernel Git Commit Fix and Kernel Git Commit Security Patch.

Detection Methods for CVE-2026-89680

Indicators of Compromise

Steady growth in nfsd_file slab allocations visible in /proc/slabinfo on NFS servers.
Rising counts of pinned dentries and inodes on exported filesystems without corresponding client activity.
Elevated rates of NFS4ERR_OFFLOAD_DENIED responses returned by the server to COPY operations.
Kernel memory pressure or OOM events on hosts running nfsd after periods of NFSv4.2 client activity.

Detection Strategies

Monitor NFSv4.2 COPY request/response telemetry and alert on abnormal ratios of failed inter-server COPY attempts from a single client.
Baseline nfsd_file and related slab cache sizes on NFS servers and alert on sustained upward trends unrelated to workload.
Correlate NFS server memory growth with client-source IP addresses issuing repeated COPY operations against non-existent or unreachable source servers.

Monitoring Recommendations

Ingest kernel slabinfo, meminfo, and nfsd statistics into a centralized log or SIEM platform for trend analysis.
Capture NFS protocol telemetry (for example via rpcdebug, nfsdclnts, or packet capture at the server edge) to identify clients driving COPY failures.
Alert on kernel warnings and dmesg entries referencing nfsd, unmount failures, or dentry pin counts that do not decrement over time.

How to Mitigate CVE-2026-89680

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix commits referenced in the NVD entry.
Restrict NFSv4.2 exports to trusted client networks using firewall rules or exports(5) host controls until patches are deployed.
Disable inter-server COPY (server-side copy) support in the NFS server configuration if the feature is not required by workloads.
Reboot NFS server hosts after patching to release any resources already pinned by prior exploitation.

Patch Information

The fix reassigns the failure code to status and jumps to the out: label so release_copy_files() runs and drops the nf_dst reference. Upstream stable backports are available at Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Security Patch, and Kernel Git Commit Improvement. Apply the kernel package updates provided by your Linux distribution.

Workarounds

Block or rate-limit NFSv4.2 COPY operations at the network layer where feasible.
Restrict NFS exports to authenticated clients using Kerberos (sec=krb5) to raise the bar for arbitrary COPY submissions.
Monitor nfsd_file slab growth and schedule controlled NFS server restarts to reclaim leaked resources between patch windows.
Where inter-server COPY is not a workload requirement, disable the feature to remove the vulnerable code path entirely.

bash

# Verify running kernel version against distribution advisories
uname -r

# Inspect nfsd-related slab caches for suspected leaks
grep -E 'nfsd_file|nfs4_' /proc/slabinfo

# Restrict NFS access to trusted subnet (example /etc/exports entry)
# /export 10.0.0.0/24(rw,sec=krb5,sync,no_subtree_check)

# Apply distribution kernel updates and reboot
sudo apt update && sudo apt upgrade linux-image-$(uname -r)
sudo systemctl reboot