Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mount

Impact

When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns nfserr_offload_denied directly and skips release_copy_files(), so the destination file reference taken during stateid processing is never dropped. Every failed inter-server COPY leaks one nfsd_file and pins a file, inode, dentry and vfsmount. A client that can repeat failing COPYs drives unbounded kernel memory growth and keeps mounts busy so they cannot be unmounted - a slow-motion outage on a file server that a GPU fleet depends on for datasets and checkpoints.

Who can reach it

Any NFSv4.2 client allowed to issue server-to-server COPY, repeatedly causing the inter-server setup to fail. Authentication is whatever the export requires; no elevated privilege is needed.

What to do

Update the host kernel to a stable release that jumps to the out: label instead of returning early, then reboot the NFS server; leaked references are not recovered without a reboot. Disabling server-to-server COPY on the export removes the path in the meantime.

References

Related entries

• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High
• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High
• Linux kernel nfsd: file returned by dentry_create() may not actually be open before useCVE-2026-89687 · Linux kernel nfsd_file_do_acquire() (dentry_create / atomic_open result handling)High
• Linux kernel nfsd: failed delegation-recall queue latches a flag and permanently blocks the recallCVE-2026-89692 · Linux kernel nfsd_break_one_deleg() (NFSD4_CALLBACK_RUNNING flag)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh