CVE-2026-23297

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23297
In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked. nfsd_svc() is also called from write_threads(), but it does not bump file->f_cred there. nfsd_nl_threads_set_doit() is called from sendmsg() and current->cred does not go away. Let's use current_cred() in nfsd_nl_threads_set_doit(). [0]: BUG: memory leak unreferenced object 0xffff888108b89480 (size 184): comm "syz-executor", pid 5994, jiffies 4294943386 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 369454a7): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270 prepare_creds+0x22/0x600 kernel/cred.c:185 copy_creds+0x44/0x290 kernel/cred.c:286 copy_process+0x7a7/0x2870 kernel/fork.c:2086 kernel_clone+0xac/0x6e0 kernel/fork.c:2651 __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c Patch
https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b Patch
https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b Patch
https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
History

29 May 2026, 14:29

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c - () https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c - Patch
References () https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b - () https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b - Patch
References () https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b - () https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b - Patch
References () https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29 - () https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: nfsd: Corrige la fuga de referencia de cred en nfsd_nl_threads_set_doit(). syzbot informó una fuga de memoria de la estructura cred. [0] nfsd_nl_threads_set_doit() pasa get_current_cred() a nfsd_svc(), pero put_cred() no es llamada después de eso. El cred es finalmente pasado a _svc_xprt_create(), que llama a get_cred() con el cred para la estructura svc_xprt. La propiedad del contador de referencias por get_current_cred() no es transferida a ningún lugar y simplemente se fuga. nfsd_svc() también es llamada desde write_threads(), pero no incrementa file->f_cred allí. nfsd_nl_threads_set_doit() es llamada desde sendmsg() y current->cred no desaparece. Usemos current_cred() en nfsd_nl_threads_set_doit(). [0]: ERROR: fuga de memoria objeto sin referencia 0xffff888108b89480 (tamaño 184): comm 'syz-executor', pid 5994, jiffies 4294943386 volcado hexadecimal (primeros 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 369454a7): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270 prepare_creds+0x22/0x600 kernel/cred.c:185 copy_creds+0x44/0x290 kernel/cred.c:286 copy_process+0x7a7/0x2870 kernel/fork.c:2086 kernel_clone+0xac/0x6e0 kernel/fork.c:2651 __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-05-29 14:29

NVD link : CVE-2026-23297

Mitre link : CVE-2026-23297

CVE.ORG link : CVE-2026-23297

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime