CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: fix layout segment leak on the pnfslayoutprocess() forget path
When the server returns a new layout stateid while a valid one is still held, pnfslayoutprocess() calls pnfsmarkmatchinglsegsreturn() on the on-stack freeme list and jumps to outforget. Segments whose reference count drops to zero are unlinked from lo->plhsegs and moved to freeme by marklseginvalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement.
outforget never drains freeme -- only the success path calls pnfsfreelseglist().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfslayoutprocess()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfslayoutprocess()") removed it while switching the destination to lo->plhreturnsegs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfslayoutprocess()") switched the destination back to freeme without restoring the drain.
Restore the pnfsfreelseglist() call.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 814b84971388 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch fb700ef02676 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 08bd8dbe8882
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using NFSv4.1 pNFS can encounter the leak when processing layouts. The triggering case is a server returning a new layout stateid while the client still holds a valid layout stateid.
What happens when the vulnerable path is reached?
Layout segments whose reference counts reach zero can be removed from the layout header and placed on the temporary free_me list. The forget path does not drain that list, leaving those layout segments leaked.
What fix should be applied?
Apply a Linux kernel update containing the restoration of the pnfs_free_lseg_list() call on the pnfs_layout_process() forget path. The provided stable-kernel references identify fixes for this issue, but no affected or fixed release versions are specified.