SB20260912123 - Memory leak in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-89664)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory in the NFS server's NFSv4 OPEN operation processing when handling malformed OPEN compounds containing valid POSIX ACL createhow4 attributes. A remote attacker can send a specially crafted malformed NFSv4 OPEN compound to cause a denial of service.

The leaked POSIX ACL references can also occur when processing replayed NFSv4.0 operations.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5b3a7d7c23c071efe12dd1bc1d2e5f97c4892921
• https://git.kernel.org/stable/c/8215892993ea9f5231da4fa9eb42428a286fce8b