Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS server

Impact

nfsd_cross_mnt() takes mntget()/dget() before follow_down() and, uniquely among its exit arms, does not path_put() when follow_down() returns an error. Each failed cross-mount inflates mnt_count and d_count permanently, which blocks umount of the underlying filesystem and pins dentries against the shrinker. Repeated over time on a busy export this is a slow resource exhaustion and an operational trap: the storage head cannot unmount a filesystem for maintenance and eventually needs a reboot. Reachable through ordinary lookup and NFSv4 READDIR paths, so no unusual client behaviour is needed.

Who can reach it

Any authenticated NFS client that can trigger a cross-mount lookup on the export, including via READDIR. Remote, network-adjacent to the storage service.

What to do

Update the NFS server kernel to a build containing the path_put() fix (stable commits 194316df8126, 2bc4343308d8, 467d56fd3ff5, 6cba08dc1922) and reboot the node. Leaked references cannot be reclaimed without a reboot, so a server already showing stuck umounts needs one regardless of when the patch lands.

References

Related entries

• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
• HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High
• Harbor registry: P2P preheat execution logs readable/updatable by any authenticated user via job ID enumerationCVE-2022-31671 · Harbor registryHigh
• MinIO (admin server-update API): An authenticated request to the server-update admin API traverses out of the intendedCVE-2022-35919 · MinIO (admin server-update API)High
• Cisco Nexus 3000/9000 (health monitoring diagnostics): The health monitoring diagnostics subsystem on Nexus 3000 andCVE-2025-20111 · Cisco Nexus 3000/9000 (health monitoring diagnostics)High