CVE-2026-23297
published 2026-03-25CVE-2026-23297: In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_set_doit().
[0]:
BUG: memory leak
unreferenced object 0xffff888108b89480 (size 184):
comm "syz-executor", pid 5994, jiffies 4294943386
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 369454a7):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
prepare_creds+0x22/0x600 kernel/cred.c:185
copy_creds+0x44/0x290 kernel/cred.c:286
copy_process+0x7a7/0x2870 kernel/fork.c:2086
kernel_clone+0xac/0x6e0 kernel/fork.c:2651
__do_sys_clone+0x7f/0xb0 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 41170716421c25cd20b39e83f0e0762e212b377b | 41170716421c25cd20b39e83f0e0762e212b377b |
| linux | linux | >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 27c13c5bb0948e3b5c64e59f8a903231896fab9b | 27c13c5bb0948e3b5c64e59f8a903231896fab9b |
| linux | linux | >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < a3f88e3e18b51a7f654189189c762ebcdeaa7e29 | a3f88e3e18b51a7f654189189c762ebcdeaa7e29 |
| linux | linux | >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 1cb968a2013ffa8112d52ebe605009ea1c6a582c | 1cb968a2013ffa8112d52ebe605009ea1c6a582c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.10 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.10.0 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.13 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2 nfsd nfsd_nl_threads_set_doit memory leak (Nessus ID 311340 / WID-SEC-2026-0861)
vuldb·2026-06-01·CVSS 5.5
CVE-2026-23297 [MEDIUM] Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2 nfsd nfsd_nl_threads_set_doit memory leak (Nessus ID 311340 / WID-SEC-2026-0861)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2. The impacted element is the function nfsd_nl_threads_set_doit of the component nfsd. The manipulation leads to memory leak.
This vulnerability is listed as CVE-2026-23297. The attack must be carried out from within the local network. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
GHSA-pxcg-3rj5-5gx5: In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
ghsa_unreviewed·2026-03-25
CVE-2026-23297 GHSA-pxcg-3rj5-5gx5: In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_set_doit().
[0]:
BUG: memory leak
unreferenced object 0xffff888108b89480 (
OSV
CVE-2026-23297: In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
osv·2026-03-25
CVE-2026-23297 CVE-2026-23297: In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked. nfsd_svc() is also called from write_threads(), but it does not bump file->f_cred there. nfsd_nl_threads_set_doit() is called from sendmsg() and current->cred does not go away. Let's use current_cred() in nfsd_nl_threads_set_doit(). [0]: BUG: memory leak unreferenced object 0xffff888108b89480 (size 184)
OSV
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
osv·2026-03-25
CVE-2026-23297 nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_set_doit().
[0]:
B
Red Hat
kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23297 [LOW] CWE-772 kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_set_doit().
[0]:
BUG
Debian
CVE-2026-23297: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix c...
vendor_debian·2026
CVE-2026-23297 [LOW] CVE-2026-23297: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix c...
In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked. nfsd_svc() is also called from write_threads(), but it does not bump file->f_cred there. nfsd_nl_threads_set_doit() is called from sendmsg() and current->cred does not go away. Let's use current_cred() in nfsd_nl_threads_set_doit(). [0]: BUG: memory leak unreferenced object 0xffff888108b89480 (size 184)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23297 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23297 CVE-2026-23297 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23297 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_se
Bugzilla
CVE-2026-23297 kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
bugzilla·2026-03-25·CVSS 5.5
CVE-2026-23297 [MEDIUM] CVE-2026-23297 kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
CVE-2026-23297 kernel: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threa
2026-03-25
Published