Linux Kernel NFSD CVE-2026-43394

The vulnerability resides in the Linux kernel's NFSD (Network File System Daemon) subsystem within nfsd_nl_listener_set_doit(), which handles Netlink-based requests to configure NFS server listeners. The root cause (CWE-401: Missing Release of Memory after Effective Lifetime) is a credential reference count imbalance: get_current_cred() increments the reference count on the calling task's credential structure, but the corresponding put_cred() was omitted. Since svc_xprt_create_from_sa() does not consume the extra reference, and current->cred is guaranteed stable throughout the sendmsg() process context, the correct fix is to use current_cred() - which reads the credential pointer without incrementing the reference count. Each invocation of the vulnerable codepath leaks one credential reference; accumulated over time, unreleased credential structures prevent the kernel from reclaiming memory, ultimately exhausting kernel memory. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected Linux kernel codebase, with the vulnerability introduced at commit 16a471177496c8e04a9793812c187a2c1a2192fa.