{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "cc53ce53c86924bfe98a12ea20b7465038a08792"
            },
            {
              "fixed": "194316df81263519156ebe714c4a286bee00e5be"
            },
            {
              "fixed": "467d56fd3ff57447a790c6dc3ede2d02a947d224"
            },
            {
              "fixed": "2bc4343308d85ee4e0dd3877b384306c96f114c2"
            },
            {
              "fixed": "6cba08dc1922140d260cfeb30bbda4ee1bf869d8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.38"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89707.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release path refs on follow_down() error\n\nnfsd_cross_mnt() initializes a local struct path with mntget() and\ndget() before calling follow_down(). On a negative return the error\narm jumps to out without releasing those references:\n\n    err = follow_down(\u0026path, follow_flags);\n    if (err \u003c 0)\n            goto out;\n\nfollow_down() never drops the caller's entry-time refs on any error\nsub-case; for example a pre-cross d_manage() failure leaves path\nuntouched, so the mntget()/dget() taken on entry survive the call.\n\nEvery other early-exit arm in nfsd_cross_mnt() (other-namespace\nreturn, IS_ERR(exp2), and the success tail after the swap) already\ncalls path_put(\u0026path); the err \u003c 0 arm is the lone omission. The\nleak inflates mnt_count and d_count on each failed cross-mount,\nblocking umount and pinning dentries against the shrinker, and is\nreachable by any authenticated NFS client through nfsd_lookup_dentry\nor the NFSv4 READDIR encode path.\n\nFix by calling path_put(\u0026path) before the goto out in the err \u003c 0\narm so the entry-time refs are released on all follow_down() error\nreturns.",
  "id": "CVE-2026-89707",
  "modified": "2026-09-13T03:30:51.738728317Z",
  "published": "2026-09-11T19:46:23.293Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/194316df81263519156ebe714c4a286bee00e5be"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2bc4343308d85ee4e0dd3877b384306c96f114c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/467d56fd3ff57447a790c6dc3ede2d02a947d224"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6cba08dc1922140d260cfeb30bbda4ee1bf869d8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89707.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89707"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "nfsd: release path refs on follow_down() error"
}