{
  "cveId": "CVE-2026-89715",
  "url": "https://patchblox.com/security/cve/CVE-2026-89715",
  "summary": "CVE-2026-89715 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89715 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  NFS/localio: fix ref leak on nfs_uuid_add_file f...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  NFS/localio: fix ref leak on nfs_uuid_add_file failure  When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid-\u003Enet, it returns -ENXIO without publishing nfl-\u003Enfs_uuid via rcu_assign_pointer().  nfs_open_local_fh() then enters its error branch and only releases the slot\u0027s file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op:      nfs_close_local_fh()       nfs_uuid = rcu_dereference(nfl-\u003Enfs_uuid);       if (!nfs_uuid) { rcu_read_unlock(); return; }  /* always */  nfsd_open_local_fh() returns localio holding a caller-owned \u002B1 nfsd_file reference (from nfsd_file_get() after nfsd_file_acquire_local()) and an entry-time nfsd_net reference (from its first nfsd_net_try_get()) embedded as nf-\u003Enf_net.  Both are leaked on the failure path, pinning one nfsd_file (and the underlying struct file, dentry, inode) and one nfsd_net_ref per occurrence, which blocks nfsd_net and netns teardown.  Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared:      struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);      nfs_to_nfsd_file_put_local(pnf);     nfs_to_nfsd_file_put_local(\u0026tmp);     localio = ERR_PTR(-ENXIO);  The trailing nfs_to_nfsd_net_put(net) continues to release the outer net ref, so all three nfsd_net_try_get() increments are balanced on the error branch.",
  "published": "2026-09-11T20:19:58Z",
  "severity": "",
  "epss": 0.00206,
  "epssPercentile": 0.10784,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89715",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89715",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}