CVE-2026-89714: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

CVE-2026-89714: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

nfs4_server_common_setup() allocates server->delegation_hash_table
first, but server->destroy - the only path that frees the table via
nfs4_destroy_server() - is not assigned until the very end of the
function. If any intermediate step fails (the is_ds_only_client()
check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()),
the function returns with server->destroy still NULL, so the caller's
nfs_free_server() skips the destroy callback and the hash table is
leaked (4 KiB per attempt with the default delegation watermark).

This is trivially reachable from userspace: every failed NFSv4 mount
leaks one allocation. A client that persistently retries a mount that
cannot succeed leaks kernel memory without bound. Observed in
production where a Longhorn backup poller retried mount.nfs4 against
an NFSv3-only server roughly 10 times per second, leaking ~3.4 GiB of
unreclaimable slab (kmalloc-rnd-13-4k) per day; the node accumulated
12 GiB of leaked slab before the source was identified via the
kmem:kmalloc tracepoint (call_site=nfs4_delegation_hash_alloc).

Reproducer:

  # server exports NFSv3 only (or export path absent for v4)
  while :; do mount -t nfs4 <server>:/missing /mnt; done
  # watch SUnreclaim in /proc/meminfo grow 4 KiB per iteration

Free the table on the error paths between the allocation and the
assignment of server->destroy.

The Linux kernel CVE team has assigned CVE-2026-89714 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit f5b3108e6a14418b120a3c38ca589b8d6cf87627 and fixed in 6.18.50 with commit f3adf1643517357221422c05986d6de5df7b9913
	Issue introduced in 6.17 with commit f5b3108e6a14418b120a3c38ca589b8d6cf87627 and fixed in 7.2.4 with commit 0fd2b9687dae36be5b84eab39b4c627bb7ab33b3
	Issue introduced in 6.17 with commit f5b3108e6a14418b120a3c38ca589b8d6cf87627 and fixed in 7.3-rc1 with commit 2092f5b38f88be306140c77aeeeb43fc1adacacc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89714
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfs/nfs4client.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f3adf1643517357221422c05986d6de5df7b9913
	https://git.kernel.org/stable/c/0fd2b9687dae36be5b84eab39b4c627bb7ab33b3
	https://git.kernel.org/stable/c/2092f5b38f88be306140c77aeeeb43fc1adacacc