CVE-2026-89707: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89707 Overview

CVE-2026-89707 is a resource leak vulnerability in the Linux kernel NFS server (nfsd) subsystem. The flaw resides in nfsd_cross_mnt(), where a failed follow_down() call skips the required path_put(&path) cleanup. Each failed cross-mount operation leaks a mount reference (mnt_count) and a dentry reference (d_count). Any authenticated NFS client can trigger the code path through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Sustained triggering exhausts kernel resources, blocks umount operations, and pins dentries against the shrinker, resulting in denial of service on the NFS server.

Critical Impact
Authenticated NFS clients can remotely exhaust kernel mount and dentry resources, blocking unmount operations and degrading NFS server availability.

Affected Products

Linux kernel NFS server (nfsd) subsystem
Kernel builds containing the pre-patch nfsd_cross_mnt() implementation
Systems exporting NFS shares that span mount points

Discovery Timeline

2026-09-11 - CVE-2026-89707 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89707

Vulnerability Analysis

The vulnerability is a reference count leak in the Linux kernel NFS server. The function nfsd_cross_mnt() initializes a local struct path by calling mntget() and dget() to acquire references on the current mount and dentry before invoking follow_down() to traverse into a submounted filesystem.

When follow_down() returns a negative error code, the function jumps to the out label without releasing the acquired references. The follow_down() helper does not drop caller-owned entry-time references on failure paths. For example, a pre-cross d_manage() failure leaves the path structure untouched, so the initial mntget() and dget() references remain outstanding.

Every other early-exit branch in nfsd_cross_mnt() — including the other-namespace return, the IS_ERR(exp2) check, and the successful tail after the swap — correctly calls path_put(&path). The err < 0 branch is the sole omission. The upstream fix adds path_put(&path) before the goto out in the failure arm.

Root Cause

The root cause is a missing cleanup call on an error path, classified as a memory or resource leak. The nfsd_cross_mnt() function acquires two references on entry but only releases them on selected exit paths. The follow_down() error path bypasses the required path_put() call, leaking one mount reference and one dentry reference per failure.

Attack Vector

Any authenticated NFS client can trigger the vulnerable code path over the network. The leak is reachable through nfsd_lookup_dentry operations or the NFSv4 READDIR encode path when a lookup crosses a mount boundary that produces a follow_down() failure. Repeated triggering inflates mnt_count and d_count, prevents umount from succeeding, and pins dentries so the shrinker cannot reclaim them. The result is a denial-of-service condition against the NFS server.

No synthetic exploitation code is included. See the upstream commits linked under references for the patch details and the exact call site.

Detection Methods for CVE-2026-89707

Indicators of Compromise

Persistent inability to unmount NFS-exported filesystems with EBUSY errors despite no active users
Continuously growing dentry cache slab usage reported by /proc/slabinfo for dentry and nfsd-related objects
Elevated NFS server memory consumption correlated with sustained NFSv4 READDIR or LOOKUP activity from a single client

Detection Strategies

Monitor kernel slab statistics for anomalous growth in dentry and mount-related caches on NFS servers
Instrument nfsd_cross_mnt() with tracepoints or eBPF probes to count follow_down() failure returns per client
Correlate NFS audit logs with mount reference counts to identify clients generating repeated cross-mount lookup failures

Monitoring Recommendations

Track umount operation failures on NFS export paths as an early signal of reference leaks
Baseline normal NFSv4 READDIR volumes and alert on outliers from individual client IPs
Ingest kernel warning logs and NFS server telemetry into a centralized data lake for longitudinal analysis

How to Mitigate CVE-2026-89707

Immediate Actions Required

Apply the upstream kernel patch that adds path_put(&path) before the goto out in the follow_down() error arm of nfsd_cross_mnt()
Upgrade to a stable Linux kernel release containing one of the fix commits listed in the references
Restrict NFS export access to trusted clients using exportfs options and network-layer access controls until patches are deployed

Patch Information

The fix is available in the upstream Linux kernel tree through multiple stable backport commits. Review the following commits for the applicable kernel branch:

Workarounds

Limit NFS exports so lookups do not cross submount boundaries where follow_down() may fail
Enforce firewall rules that restrict NFS ports (2049/tcp and RPC ancillary ports) to authenticated, trusted client networks
Schedule periodic NFS server restarts to reclaim leaked references until the kernel patch is applied

bash

# Verify installed kernel version and confirm the fix commit is present
uname -r
rpm -q --changelog kernel | grep -i 'nfsd_cross_mnt\|follow_down' | head

# Restrict NFS access at the export level (example /etc/exports entry)
# /srv/export  10.0.0.0/24(rw,sync,no_subtree_check,sec=krb5)
exportfs -ra

# Restrict NFS ports at the host firewall
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" service name="nfs" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" service name="nfs" drop'
firewall-cmd --reload