CVE-2026-23038

What it actually does

Memory leak occurs in nfs4_ff_alloc_deviceid_node when ds_versions allocation fails, causing an unconditional jump to out_scratch that bypasses freeing of the previously allocated dsaddrs list.

Why it matters to the business

Systems relying on NFS flexible file layouts may experience gradual kernel memory exhaustion, resulting in degraded performance, increased swapping, or eventual system instability if the leak path is repeatedly triggered.

How an attack unfolds

An attacker with the ability to induce allocation failures during NFS device ID node setup can cause repeated leaks; the flaw is triggered by normal NFS operations hitting the error path rather than by direct malicious input.

How to fix it

Update the Linux kernel to a version containing commit e2dde5dafb80f1af4028ed10ad255f42af71c784 or later; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit e2dde5dafb80f1af4028ed10ad255f42af71c784; inspect the source of nfs4_ff_alloc_deviceid_node to verify the correct error label is used.

Typical attack path

1. Establish an NFS mount using the flexible files layout
2. Force the kernel into the ds_versions allocation failure path inside nfs4_ff_alloc_deviceid_node
3. Repeat the triggering condition to accumulate unfreed dsaddrs memory

How to detect it

Inspect kernel memory statistics and slab allocator usage for repeated allocations tied to NFS device ID structures; correlate with NFS mount and layout operations in system logs.

What your security team should do

• Apply the referenced kernel commit immediately on all systems using NFS flexible files layouts
• Monitor memory usage on NFS servers for unexpected growth until patches are deployed
• Review NFS configuration to determine exposure breadth across the environment