CVE-2026-89714: In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server_comm

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails nfs4_server_common_setup() allocates server->delegation_hash_table first, but server->destroy - the only path that frees the table via nfs4_destroy_server() - is not assigned until the very end of the function. If any intermediate step fails (the is_ds_only_client() check, nfs4_init_session(), nfs4_get_rootfh(), or nfs_probe_server()), the function returns with server->destroy still NULL, so the caller's nfs_free_server() skips the destroy callback and the hash table is leaked (4 KiB per attempt with the default delegation watermark). This is trivially reachable from userspace: every failed NFSv4 mount leaks one allocation. A client that persistently retries a mount that cannot succeed leaks kernel memory without bound. Observed in production where a Longhorn backup poller retried mount.nfs4 against an NFSv3-only server roughly 10 times per second, leaking ~3.4 GiB of unreclaimable slab (kmalloc-rnd-13-4k) per day; the node accumulated 12 GiB of leaked slab before the source was identified via the kmem:kmalloc tracepoint (call_site=nfs4_de

Description from the National Vulnerability Database, published by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

What it means for a small business

Linux is on the computers, phones or browsers your team uses every day. Turn on automatic updates and restart: most of these fixes only take effect after a restart.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.21%, higher than 10% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored October 29, 2026, updated daily.

Check your own setup

Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.