CVE Explorer

CVE-2026-23297

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:76272d51d471d39dac095c50a244f0bfebd7300157af341404158693c5636ae3

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.77","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.17","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.7","versionType":"semver"},{"lessThanOrEqua…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"41170716421c25cd20b39e83f0e0762e212b377b","status":"affected","version":"924f4fb003ba114c60b3c07a011dcd86a8956cd1","versionType":"git"},{"lessThan":"27c13c5bb0948e3b5c64e59f8a903231896fab9b","status":"affected","version":"924f4fb003ba114c60b3c07a011dcd86a8956cd1","versionType":"git"},{"lessThan":"a3f88e3e18b51a7f654189189c762ebcdeaa7e29","status":"affected","version":"924f4fb003ba114c60b3c07a011dc…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/affected/0

Source references

4 source assertions

{"url":"https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:37ee55e147d5815bd4cea6e0ac50b015a3fb083a2a5b494d007df0e04fec7dde · sha256:b461f9fda33f8b05… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer