Homepage

Improper Update of Reference Count Affecting python3-perf package, versions *

Severity

 Recommended
low

Based on CentOS security rating.

Threat Intelligence

EPSS
0.2% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-PYTHON3PERF-19838141
  • published16 Sept 2026
  • disclosed11 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 11 Sep 2026

NewCVE-2026-89715  (opens in a new tab)
CWE-911  (opens in a new tab)

How to fix?

There is no fixed version for Centos:10 python3-perf.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3-perf package and not the python3-perf package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: fix ref leak on nfs_uuid_add_file failure

When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via rcu_assign_pointer(). nfs_open_local_fh() then enters its error branch and only releases the slot's file ref and its paired net ref plus its own entry-time net ref, while the close path is a no-op:

nfs_close_local_fh()
  nfs_uuid = rcu_dereference(nfl->nfs_uuid);
  if (!nfs_uuid) { rcu_read_unlock(); return; }  /* always */

nfsd_open_local_fh() returns localio holding a caller-owned +1 nfsd_file reference (from nfsd_file_get() after nfsd_file_acquire_local()) and an entry-time nfsd_net reference (from its first nfsd_net_try_get()) embedded as nf->nf_net. Both are leaked on the failure path, pinning one nfsd_file (and the underlying struct file, dentry, inode) and one nfsd_net_ref per occurrence, which blocks nfsd_net and netns teardown.

Fix by releasing the caller-owned file ref and its net ref through the existing helper, using a stack-local RCU pointer so the helper can xchg it out, then returning -ENXIO so callers do not dereference a localio whose slot has been cleared:

struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);


nfs_to_nfsd_file_put_local(pnf);
nfs_to_nfsd_file_put_local(&tmp);
localio = ERR_PTR(-ENXIO);

The trailing nfs_to_nfsd_net_put(net) continues to release the outer net ref, so all three nfsd_net_try_get() increments are balanced on the error branch.

CVSS Base Scores

version 3.1