{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails  nfs4_server_common_setup() allocates server-\u003edelegation_hash_table first, but server-\u003edestroy - the only path that frees the table via nfs4_destroy_server() - is not assigned until the very end of the function. If any intermediate step fails (the is_ds_only_client() check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()), the function returns with server-\u003edestroy still NULL, so the caller's nfs_free_server() skips the destroy callback and the hash table is leaked (4 KiB per attempt with the default delegation watermark).  This is trivially reachable from userspace: every failed NFSv4 mount leaks one allocation. A client that persistently retries a mount that cannot succeed leaks kernel memory without bound. Observed in production where a Longhorn backup poller retried mount.nfs4 against an NFSv3-only server roughly 10 times per second, leaking ~3.4 GiB of unreclaimable slab (kmalloc-rnd-13-4k) per day; the node accumulated 12 GiB of leaked slab before the source was identified via the kmem:kmalloc tracepoint (call_site=nfs4_delegation_hash_alloc).  Reproducer:    # server exports NFSv3 only (or export path absent for v4)   while :; do mount -t nfs4 \u003cserver\u003e:/missing /mnt; done   # watch SUnreclaim in /proc/meminfo grow 4 KiB per iteration  Free the table on the error paths between the allocation and the assignment of server-\u003edestroy.",
  "id": "DEBIAN-CVE-2026-89714",
  "modified": "2026-09-12T08:47:27.761952872Z",
  "published": "2026-09-11T20:19:58.873Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89714"
    }
  ],
  "upstream": [
    "CVE-2026-89714"
  ]
}