CVE-2026-89710 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement.
out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()") removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()") switched the destination back to free_me without restoring the drain.
Restore the pnfs_free_lseg_list() call.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified involves a resource leak within the Linux kernel's NFS version 4.1 implementation, specifically affecting the parallel network file system subsystem known as pNFS. The core issue resides in the function pnfs_layout_process(), which is responsible for managing layout segments that define how data is distributed across storage servers. When a server returns a new layout stateid while the client still holds a valid one, the code path invokes pnfs_mark_matching_lsegs_return() to handle existing segments and then jumps to an out_forget label intended for cleanup operations. During this process, layout segments whose reference counts drop to zero are unlinked from the main list of active segments and moved to a local on-stack free_me list via mark_lseg_invalid(). For idle cached segments, the layout header typically holds the only remaining reference, meaning these resources become eligible for immediate deallocation upon the first decrement.
The technical flaw arises because the out_forget code path fails to drain or process this free_me list before returning control to the caller. While the success path correctly calls pnfs_free_lseg_list() to ensure all allocated layout segments are properly freed, the error handling and forget paths neglect this critical step. This omission results in a memory leak where kernel memory associated with these invalidated layout segments is never released back to the system. The root cause of this regression can be traced through several historical commits that modified the pNFS codebase. An earlier fix had correctly added the draining logic, but subsequent refactoring efforts aimed at optimizing how invalid layouts were returned inadvertently removed this safeguard by switching the destination list and assuming it would be drained elsewhere. A later simplification reverted the destination back to free_me without restoring the necessary cleanup call, thereby reintroducing the leak condition.
From an operational perspective, this vulnerability leads to a gradual depletion of kernel memory resources over time. As clients interact with NFSv4.1 servers that trigger this specific code path repeatedly, the accumulated unreleased layout segments consume increasing amounts of physical and virtual memory within the Linux kernel space. In environments with high-frequency file operations or large-scale distributed storage deployments, this leak can escalate into a significant stability risk. Eventually, the continuous allocation without corresponding deallocation may lead to out-of-memory conditions, causing system instability, application crashes, or even complete node failure if the kernel cannot allocate memory for other critical functions. This represents a classic denial of service scenario driven by resource exhaustion rather than direct exploitation by an attacker, although it could be exacerbated in scenarios involving malicious clients sending frequent layout updates designed to trigger this path repeatedly.
This vulnerability aligns with CWE-401, which describes the failure to release memory after it has been successfully allocated, leading to a leak of resources that are not freed before they go out of scope. In terms of attack vectors and techniques, while primarily a stability issue, such resource leaks can be leveraged in denial-of-service attacks as described by MITRE ATT&CK technique T1499, specifically under endpoint denial of service where the attacker overwhelms system resources to degrade or halt operations. Mitigation strategies for this vulnerability involve applying kernel patches that restore the pnfs_free_lseg_list() call within the out_forget path of pnfs_layout_process(). System administrators should ensure their Linux kernels are updated to versions containing the fix for this specific regression in the NFSv4.1 pNFS implementation. Regular monitoring of system memory usage and kernel logs can help detect early signs of resource leaks, allowing for proactive intervention before critical thresholds are reached.