CVE-2026-89680

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfsd_file leak on inter-server COPY setup failure

When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly, bypassing the out: label where release_copy_files() would drop the nf_dst reference taken by nfs4_preprocess_stateid_op(). Each failed inter-server COPY leaks one nfsd_file, pinning file/inode/dentry/vfsmount.

Fix by setting status and jumping to out: instead of returning directly.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ce0887ac96d35c7105090e166bb0807dc0a0e838, < d15f76fddc5d0215db5f18851048376a1ea79bd6; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < eb22420e5bd6eb3afa1f840036bb08a7ac90db76; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < 94c28af6fd89cb204975e49b824f8ee521bb84e9; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < ab949252fdf102ae74329a0caa7995a849d0dafa; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < 1a6a41b848455bf6ba2c9da2dfb0730e608ce7ab; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < 424d5c95108a4809b832cb0a312c61de4aec0078; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < 6ed8d6de7ec90c4ba84eb82673058f506e5777fd; >= ce0887ac96d35c7105090e166bb0807dc0a0e838, < 88a76145451d703eedd867b5989bf73d17340399
LinuxLinux5.6

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-896819.8In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue coreCVE-2026-896828.1In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net CVE-2026-89683In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd_set_CVE-2026-896847.5In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpnCVE-2026-896857.5In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_CVE-2026-896869.8In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revCVE-2026-896877.5In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->aCVE-2026-896889.8In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry ICVE-2026-896899.8In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() CVE-2026-89698.1Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-896907.8In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_statusCVE-2026-896917.1In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_re
CVE-2026-89680: High severity, CVSS 7.5 | Vulnix