Cloudanix VulnDB

CVE-2026-89710

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain network file layouts can slowly waste memory on computers that connect to advanced file servers, which may eventually cause slowdowns or crashes.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in pnfs_layout_process() on the out_forget path when a new layout stateid is returned while a valid one is held; segments moved to free_me are never drained because pnfs_free_lseg_list() is not called.

Why it matters to the business

Gradual kernel memory exhaustion on NFS clients can lead to performance degradation, OOM conditions, or system instability for workloads relying on pNFS/NFSv4.1, increasing operational risk for storage-dependent environments.

How an attack unfolds

An attacker with the ability to serve or influence an NFSv4.1 pNFS layout response that returns a fresh stateid while one remains valid can repeatedly trigger the leak path; the missing drain on free_me allows reference-counted segments to be lost without being freed.

How to fix it

Apply the upstream fix that restores the pnfs_free_lseg_list() call on the out_forget path; rebuild and deploy the corrected kernel to all affected systems. Monitor for updated distribution packages once released.

How to confirm the fix worked

Confirm the presence of the restored pnfs_free_lseg_list() call in pnfs_layout_process(); verify via code review or by exercising the layout stateid transition path and checking that free_me is drained.

Typical attack path

  1. Establish an NFSv4.1 mount with pNFS enabled
  2. Induce the server to return a new layout stateid while a prior valid stateid is cached
  3. Force repeated calls through pnfs_layout_process() into the forget path
  4. Accumulate unreleased segments until memory pressure manifests

How to detect it

Inspect kernel slab allocator statistics and NFS layout-related memory counters for unexpected growth; correlate with NFSv4.1 mount activity and stateid transitions in system logs.

What your security team should do

  • Prioritize kernel updates for all NFSv4.1 pNFS clients
  • Review NFS mount configurations to limit pNFS usage where feasible until patched
  • Monitor memory usage on NFS clients for unexpected growth in layout-related slabs

The record

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement. out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list(). Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()") removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()") switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list() call.

Affected packages

Ecosystem Package Introduced Fixed