Skip to main content

Linux Kernel EUVDEUVD-2026-27756

| CVE-2026-43193 MEDIUM
2026-05-06 Linux GHSA-7gfx-7jvh-p5vw
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector and low privilege required to reach nfsd_get_dir_deleg(); impact is purely availability via resource exhaustion with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:03 vuln.today
CVSS changed
May 11, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg()

Claude pointed out that there is a nfs4_file refcount leak in nfsd_get_dir_deleg(). Ensure that the reference to "fp" is released before returning.

AnalysisAI

Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.

Technical ContextAI

The affected code resides in the Linux kernel's NFS server (nfsd) implementation, specifically in nfsd_get_dir_deleg(), which handles NFSv4 directory delegation requests. The nfs4_file structure employs reference counting to manage the lifecycle of NFS file objects; callers must decrement the count when done with a reference. The bug is a reference count leak - when the function exits early via certain return paths, it fails to call the appropriate release function on the fp (nfs4_file pointer), leaving the reference count artificially elevated. Repeated triggering prevents the kernel from ever freeing those objects, progressively exhausting available nfs4_file resources. Though no CWE is formally assigned, this is characteristic of CWE-401 (Missing Release of Memory after Effective Lifetime). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the mainline Linux kernel; downstream distributions noted in the tags - Red Hat and SUSE - carry their own patched kernel packages.

RemediationAI

The primary fix is to update to Linux kernel 6.19.6 or apply the upstream stable patches available at https://git.kernel.org/stable/c/789477b849394afdb60507924d65f7ef18f078ce and https://git.kernel.org/stable/c/0d8362e15aad5b5c1d6a65bb23ac6c45ccf881f3. Administrators running Red Hat or SUSE distributions should apply vendor-supplied kernel updates as they become available through standard package channels. As a compensating control, systems that do not require NFS server functionality can disable or mask the nfsd service (e.g., systemctl mask nfs-server), which eliminates the attack surface entirely at the cost of removing NFS serving capability. For environments that must continue serving NFS, restricting local user access to the minimal necessary accounts reduces the pool of potential trigger sources, though this is not a substitute for patching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27756 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy