Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compound

Impact

nfsd4_decode_fattr4() allocates refcounted posix_acl objects into open->op_pacl and op_dpacl, but OP_OPEN had no .op_release, and the release pair lived inside nfsd4_open(). When nfsd4_decode_open_claim4() returns a non-seqid-mutating error the dispatcher short-circuits and nfsd4_open() never runs, so both ACL references leak on every malformed OPEN compound that carried valid POSIX ACL createhow4 attributes. Resources attached to op->u also leaked on the v4.0 replay encoding path. A client can repeat the malformed compound freely, so this is an unbounded kernel memory leak driven remotely against a shared storage server - the failure mode is memory pressure and eventual OOM on a node the whole fleet mounts.

Who can reach it

Any client that can mount the NFSv4 export and send OPEN compounds, under normal export authentication. No server-local access needed.

What to do

Upgrade to a stable kernel with the referenced commits and reboot the NFS server, draining or failing over clients first. Until then, watch slab growth on the server; there is no runtime knob that disables the path short of dropping NFSv4. The record names commits, not fixed release numbers.

References

Related entries

• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored
• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored
• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored
• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored
• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored
• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored