Linux kernel nfsd: dentry reference leak on every crafted NFSv3 filehandle against a V4ROOT export

Impact

nfsd_set_fh_dentry() drops the dentry reference returned by exportfs_decode_fh_raw() when an NFS3_FHSIZE or NFS_FHSIZE filehandle resolves to an NFSEXP_V4ROOT export: the error path calls exp_put() but never dput(), and fhp->fh_dentry was never set so fh_put() cannot clean up. A client that repeats such a request leaks a dentry reference per call, pinning dentries and their inodes indefinitely. Sustained, that is unbounded kernel memory growth and an unremovable mount on the NFS server, which in an HPC or GPU cluster is the shared dataset and checkpoint server every job depends on. The record carries no CVSS score and no CWE.

Who can reach it

Any client that can reach the NFS server's RPC port and send NFSv3 requests, using a filehandle crafted to carry the fsid of a V4ROOT export. No valid file access is needed - the leak happens on the lookup path before any permission decision. Servers that export nothing with the V4ROOT flag are not affected.

What to do

Patch the kernel on NFS servers with the stable commits linked in the record and reboot; nfsd is in-kernel, so there is no daemon-restart fix. Until then, the exposure can be narrowed by restricting which networks reach the server's NFS port and by reviewing whether any V4ROOT (NFSv4 pseudo-root) exports are actually needed. Rebooting a storage server means an outage window for every job holding its mounts.

References

Related entries

• Linux nfsd: ACL translation errors in NFSv4 CREATE are discarded and the file is created without the requested ACLCVE-2026-89693 · Linux kernel nfsd (nfsd4_create ACL error handling)Unscored
• Linux nfsd: any authenticated NFSv4.2 client can cancel and free another client's copy-notify stateidCVE-2026-89694 · Linux kernel nfsd (NFSv4.2 copy-notify stateid)Unscored
• Linux nfsd: unprivileged netlink dump leaks 8 bytes of rq_flags and truncates IPv6 client addressesCVE-2026-89698 · Linux kernel nfsd (NFSD_CMD_RPC_STATUS_GET netlink, nfsd_genl_rqstp)Unscored
• Linux nfsd: NFSD_A_SOCK_ADDR has no minimum length, giving a 12-byte out-of-bounds read in listener_setCVE-2026-89700 · Linux kernel nfsd (nfsd_nl_listener_set_doit, NFSD_A_SOCK_ADDR netlink policy)Unscored
• Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to diskCVE-2026-89701 · Linux kernel nfsd (TIME_DELEG_ACCESS/TIME_DELEG_MODIFY nseconds decode)Unscored
• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored