PatchSiren cyber security CVE debrief

CVE-2026-43394 Linux CVE debrief

A credential reference leak in the Linux kernel's NFS server (nfsd) netlink listener configuration allows local attackers to cause denial of service through memory exhaustion. The vulnerability exists in nfsd_nl_listener_set_doit() which used get_current_cred() without a corresponding put_cred(), causing the credential structure to leak on each invocation. The fix replaces get_current_cred() with current_cred() since svc_xprt_create_from_sa() does not require the extra reference count and the function always executes in process context where current->cred remains valid.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-08
Original CVE updated: 2026-05-26
Advisory published: 2026-05-08
Advisory updated: 2026-05-26

Who should care

Linux system administrators operating NFS servers; security teams managing kernel attack surface; organizations with strict memory resource constraints on file server infrastructure

Technical summary

The nfsd_nl_listener_set_doit() function in the Linux kernel's NFS server implementation incorrectly used get_current_cred() to obtain the current task's credentials without releasing the reference via put_cred(). This caused a credential structure leak on each netlink listener configuration operation. Since the function executes only in process context during sendmsg() handling, current->cred does not require reference counting protection. The fix substitutes current_cred() which returns the credential pointer without incrementing the reference count. Affected versions span 6.10 through 6.12.77, 6.13 through 6.18.18, 6.19 through 6.19.8, and 7.0-rc1/rc2. Exploitation requires local privileges to invoke the netlink interface, with impact limited to availability degradation through memory exhaustion rather than confidentiality or integrity compromise.

Defensive priority

medium

Recommended defensive actions

Apply kernel patches from stable branches: 6.12.78+, 6.18.19+, 6.19.9+, or 7.0-rc3+
Monitor systems running NFS server with netlink listener configuration for unusual memory consumption
Restrict local access to NFS server configuration interfaces to trusted administrators
Upgrade to patched kernel version once available through distribution channels

Evidence notes

Official CVE record published 2026-05-08; NVD analysis added 2026-05-26. Kernel patches available for affected stable branches. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms local attack vector with low complexity.

Sources and references

Verified primary and authoritative sources

CVE-2026-43394 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-43394

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-43394 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43394

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/019debe5851d7355bea9ff0248cc317878924d8f

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/02e87ec0bc706cb93fa47b43d18c4d10102c7d54

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/92978c83bb4eef55d02a6c990c01c423131eefa7

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/cba413765376bb466035c9160fa3130402971e2c

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.