CVE-2026-89715: Linux Kernel NFS Race Condition Vulnerability

CVE-2026-89715 Overview

CVE-2026-89715 is a reference count leak in the Linux kernel's Network File System (NFS) localio subsystem. The flaw resides in nfs_uuid_add_file(), which can race with nfs_uuid_put() during teardown of uuid->net. When this race occurs, the function returns -ENXIO without publishing nfl->nfs_uuid through rcu_assign_pointer(), causing nfs_open_local_fh() to enter its error branch and leak references.

Each occurrence pins one nfsd_file reference along with the underlying struct file, dentry, and inode, plus one nfsd_net_ref. The leaked references block nfsd_net and network namespace teardown.

Critical Impact
Repeated failure paths leak kernel resources that prevent network namespace and NFS daemon teardown, causing resource exhaustion over time.

Affected Products

Linux kernel — NFS/localio subsystem
Kernel versions containing the affected nfs_uuid_add_file() implementation prior to the fix commits
Distributions shipping kernels with NFS localio support enabled

Discovery Timeline

2026-09-11 - CVE-2026-89715 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89715

Vulnerability Analysis

The defect is a memory and reference leak on an error path within the NFS localio code path. nfsd_open_local_fh() returns a caller-owned +1nfsd_file reference obtained via nfsd_file_get() after nfsd_file_acquire_local(). It also holds an entry-time nfsd_net reference from its first nfsd_net_try_get() embedded as nf->nf_net.

When nfs_uuid_add_file() fails after racing with nfs_uuid_put(), both the caller-owned file reference and its paired net reference are leaked. The close path is a no-op because nfs_close_local_fh() observes a NULL nfl->nfs_uuid and returns immediately without releasing any references.

The leaked nfsd_file pins the underlying struct file, dentry, and inode. The leaked nfsd_net_ref prevents nfsd_net and network namespace teardown, which can accumulate across many failure events.

Root Cause

The root cause is a race condition [CWE-362] between nfs_uuid_add_file() and nfs_uuid_put(). The former returns -ENXIO after failing to publish the RCU pointer, but the caller does not free the references it already owns. The nfs_close_local_fh() helper unconditionally returns when nfs_uuid is NULL, so no compensating cleanup occurs on this branch.

Attack Vector

Exploitation requires local activity that repeatedly triggers the race window during namespace or NFS teardown. A local user or workload capable of driving concurrent NFS localio open operations against a network namespace being torn down can accumulate leaked references. The impact is denial of service through resource exhaustion and blocked namespace teardown rather than remote code execution.

The fix releases the caller-owned file reference and its net reference through the existing helper using a stack-local RCU pointer so the helper can xchg it out, then returns -ENXIO. This balances all three nfsd_net_try_get() increments on the error branch. See the upstream fix commit for the exact patch content.

Detection Methods for CVE-2026-89715

Indicators of Compromise

Persistent nfsd_file and nfsd_net_ref reference counts that do not decrement after NFS clients disconnect.
Network namespaces that fail to unmount or complete teardown after NFS localio activity.
Kernel log entries reporting -ENXIO returns from nfs_uuid_add_file() correlated with namespace teardown.

Detection Strategies

Audit installed kernel versions against the fix commits 5215e734bf7c, 9f59b05423ed, and ca018c19e0ba in the stable kernel tree.
Monitor /proc/slabinfo for growth of nfsd_file and related NFS server slab caches without matching release activity.
Track unshare and container lifecycle events that leave lingering network namespaces after termination.

Monitoring Recommendations

Enable kernel tracepoints on NFS localio open and close operations to detect asymmetric reference accounting.
Alert on host memory pressure or slab growth trends correlated with NFS server workloads running in containers.
Correlate NFS localio errors with namespace teardown telemetry to identify hosts accumulating leaked references.

How to Mitigate CVE-2026-89715

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel commit tree to eliminate the reference leak.
Track distribution advisories from your Linux vendor and schedule kernel updates that include the fix commits.
Reboot affected hosts after patching to clear any previously leaked kernel references.

Patch Information

The fix is committed to the stable Linux kernel tree in three commits: 5215e734bf7c, 9f59b05423ed, and ca018c19e0ba. The corrected code path releases the caller-owned nfsd_file reference and its associated net reference through the existing helper before returning -ENXIO.

Workarounds

Disable NFS localio optimization on affected hosts where operationally acceptable until the patched kernel is deployed.
Avoid rapid teardown of network namespaces that host NFS localio workloads to reduce race window exposure.
Restrict local access on multi-tenant systems to limit workloads that can drive concurrent NFS localio operations.

bash

# Verify kernel version after patching
uname -r

# Confirm fix commits are present in the running kernel source
git -C /usr/src/linux log --oneline | grep -E "5215e734bf7c|9f59b05423ed|ca018c19e0ba"