CVE-2026-23297: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23297 is a credential reference leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem, specifically in the nfsd_nl_threads_set_doit() function. The function calls get_current_cred() to obtain a credential reference that is passed to nfsd_svc(), but the corresponding put_cred() is never called, causing a kernel memory leak of the struct cred object. Affected kernel versions include 6.10.x before 6.12.77, 6.13.x before 6.18.17, 6.19.x before 6.19.7, and release candidates 7.0-rc1 and 7.0-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). In nfsd_nl_threads_set_doit(), get_current_cred() increments the reference count of the current process's credential structure and returns a pointer, which is then passed to nfsd_svc(). That function eventually passes the credential to _svc_xprt_create(), which calls get_cred() again for the svc_xprt structure — but the original reference obtained by get_current_cred() is never released via put_cred(). The fix replaces get_current_cred() with current_cred(), which returns a pointer without incrementing the reference count, eliminating the leak. The vulnerability was originally discovered and reported by syzbot (Red Hat Bugzilla, Red Hat Advisory).

Exploitation of this vulnerability is limited to a local denial-of-service condition. A local user with sufficient privileges to invoke NFS daemon thread configuration operations via netlink commands can repeatedly trigger the credential reference leak, gradually exhausting kernel memory and eventually causing the system to become unresponsive or crash. There is no impact on confidentiality or integrity — only availability is affected (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream Linux kernel patch that replaces get_current_cred() with current_cred() in nfsd_nl_threads_set_doit(). Fixed versions include Linux kernel 6.12.77, 6.18.17, and 6.19.7. Patches are available via the stable kernel tree at git.kernel.org. Downstream distributions including Red Hat, Amazon Linux 2023, Debian, and openSUSE have issued or are tracking advisories. As a workaround, restricting local user access to netlink NFS daemon configuration interfaces can reduce exposure (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was reported to Red Hat's security response team via OSIDB and tracked in Red Hat Bugzilla with low priority and severity ratings, consistent with its limited local-only impact. No notable researcher commentary or significant media coverage has been identified beyond standard distribution advisories from Amazon Linux, Debian, and openSUSE (Red Hat Bugzilla).