Medium 5.5Published Mar 25, 2026

CVE-2026-23297nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

Updated under an hour ago (Oct 27, 2026, 7:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked. nfsd_svc() is also called from write_threads(), but it does not bump file->f_cred there. nfsd_nl_threads_set_doit() is called from sendmsg() and current->cred does not go away. Let's use current_cred() in nfsd_nl_threads_set_doit(). [0]: BUG: memory leak unreferenced object 0xffff888108b89480 (size 184): comm "syz-executor", pid 5994, jiffies 4294943386 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 369454a7): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270 prepare_creds+0x22/0x600 kernel/cred.c:185 copy_creds+0x44/0x290 kernel/cred.c:286 copy_process+0x7a7/0x2870 kernel/fork.c:2086 kernel_clone+0xac/0x6e0 kernel/fork.c:2651 __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 924f4fb003ba114c60b3c07a011dcd86a8956cd1 before 41170716421c25cd20b39e83f0e0762e212b377b; 924f4fb003ba114c60b3c07a011dcd86a8956cd1 builds before 27c13c5bb0948e3b5c64e59f8a903231896fab9b; from 924f4fb003ba114c60b3c07a011dcd86a8956cd1 before a3f88e3e18b51a7f654189189c762ebcdeaa7e29; 924f4fb003ba114c60b3c07a011dcd86a8956cd1 builds before 1cb968a2013ffa8112d52ebe605009ea1c6a582c	CNA record
linux linux_kernel linux:linux_kernel	from 6.10 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b	patch
https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b	patch
https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29	patch
https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.