---
id: CVE-2026-23297
title: 'nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

  syzbot reported memory leak of struct cred. [0]

  nfsd_nl_threads_set_doit() passes get_current_cred() to
  nfsd_sv…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 <
    41170716421c25cd20b39e83f0e0762e212b377b
  - >-
    Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 <
    27c13c5bb0948e3b5c64e59f8a903231896fab9b
  - >-
    Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 <
    a3f88e3e18b51a7f654189189c762ebcdeaa7e29
  - >-
    Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 <
    1cb968a2013ffa8112d52ebe605009ea1c6a582c
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:25:38.838487Z'
published: '2026-03-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:36.423Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23297'
references:
  - url: 'https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b'
  - url: 'https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b'
  - url: 'https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29'
  - url: 'https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.0237
ingestedAt: '2026-11-05T22:38:32.112Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

syzbot reported memory leak of struct cred. [0]

nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.

The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.

The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.

nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.

nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.

Let's use current_cred() in nfsd_nl_threads_set_doit().

[0]:
BUG: memory leak
unreferenced object 0xffff888108b89480 (size 184):
  comm "syz-executor", pid 5994, jiffies 4294943386
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 369454a7):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
    prepare_creds+0x22/0x600 kernel/cred.c:185
    copy_creds+0x44/0x290 kernel/cred.c:286
    copy_process+0x7a7/0x2870 kernel/fork.c:2086
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

## Affected

- `Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 41170716421c25cd20b39e83f0e0762e212b377b`
- `Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 27c13c5bb0948e3b5c64e59f8a903231896fab9b`
- `Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < a3f88e3e18b51a7f654189189c762ebcdeaa7e29`
- `Linux >= 924f4fb003ba114c60b3c07a011dcd86a8956cd1 < 1cb968a2013ffa8112d52ebe605009ea1c6a582c`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.