CVE-2026-89710

Received Received - Intake

Memory Leak in Linux Kernel NFSv4.1

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement. out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list(). Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()") removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()") switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list() call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89710

EUVD

EUVD-2026-76622

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the NFSv4.1 protocol implementation. When a server returns a new layout stateid while a valid one is still active, the pnfs_layout_process() function fails to properly clean up layout segments. This causes segments with zero references to remain linked in memory, leading to a leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFSv4.1 implementation and does not provide direct detection commands. Monitoring kernel logs for NFS-related errors or crashes may indicate exploitation. Check for kernel versions affected by this issue (commit 814b84971388, 08bd8dbe8882, fb700ef02676).

Commands to check kernel version: uname -r. Review NFS server/client logs for layout segment errors or memory leaks.

Impact Analysis

The leak can cause system memory exhaustion over time, potentially leading to performance degradation or crashes. Systems relying on NFSv4.1 for file sharing may experience instability or unexpected behavior due to accumulated memory usage.

Compliance Impact

This vulnerability is a memory leak in the Linux kernel's NFSv4.1 implementation. It does not directly impact data privacy or security controls required by GDPR or HIPAA. The issue involves improper cleanup of layout segments, which could lead to resource exhaustion but does not expose or leak sensitive data.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. If patching is not immediately possible, consider disabling NFSv4.1 features or restricting NFS access until the fix is applied.

Monitor system memory usage for leaks related to NFS layout segments. Restart NFS services after applying patches to ensure changes take effect.

Hi! I’m here to help you understand CVE-2026-89710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70