CVE-2026-43394

nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

nfsd_nl_listener_set_doit() uses get_current_cred() without

put_cred().

As we can see from other callers, svc_xprt_create_from_sa()

does not require the extra refcount.

nfsd_nl_listener_set_doit() is always in the process context,

sendmsg(), and current->cred does not go away.

Let's use current_cred() in nfsd_nl_listener_set_doit().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2026-05-08T14:21Z
EPSS history
Timeline
  • 08 MAY 14:21Z
    nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
    cvelistv5