---
id: CVE-2026-43394
title: 'nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

  nfsd_nl_listener_set_doit() uses get_current_cred() without
  put_cred().

  As we can see from other callers, svc_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa <
    02e87ec0bc706cb93fa47b43d18c4d10102c7d54
  - >-
    Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa <
    019debe5851d7355bea9ff0248cc317878924d8f
  - >-
    Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa <
    cba413765376bb466035c9160fa3130402971e2c
  - >-
    Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa <
    92978c83bb4eef55d02a6c990c01c423131eefa7
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:36:52.935179Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:51.043Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43394'
references:
  - url: 'https://git.kernel.org/stable/c/02e87ec0bc706cb93fa47b43d18c4d10102c7d54'
  - url: 'https://git.kernel.org/stable/c/019debe5851d7355bea9ff0248cc317878924d8f'
  - url: 'https://git.kernel.org/stable/c/cba413765376bb466035c9160fa3130402971e2c'
  - url: 'https://git.kernel.org/stable/c/92978c83bb4eef55d02a6c990c01c423131eefa7'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01995
ingestedAt: '2026-11-06T15:54:03.928Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

nfsd_nl_listener_set_doit() uses get_current_cred() without
put_cred().

As we can see from other callers, svc_xprt_create_from_sa()
does not require the extra refcount.

nfsd_nl_listener_set_doit() is always in the process context,
sendmsg(), and current->cred does not go away.

Let's use current_cred() in nfsd_nl_listener_set_doit().

## Affected

- `Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa < 02e87ec0bc706cb93fa47b43d18c4d10102c7d54`
- `Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa < 019debe5851d7355bea9ff0248cc317878924d8f`
- `Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa < cba413765376bb466035c9160fa3130402971e2c`
- `Linux >= 16a471177496c8e04a9793812c187a2c1a2192fa < 92978c83bb4eef55d02a6c990c01c423131eefa7`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.