CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

When the server returns a new layout stateid while a valid one is still
held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
the on-stack free_me list and jumps to out_forget. Segments whose
reference count drops to zero are unlinked from lo->plh_segs and moved
to free_me by mark_lseg_invalid(); for an idle cached segment the layout
header holds the only reference, so this happens on the first decrement.

out_forget never drains free_me -- only the success path calls
pnfs_free_lseg_list().

Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in
pnfs_layout_process()") added the drain; commit 08bd8dbe8882
("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")
removed it while switching the destination to lo->plh_return_segs, which
is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout
return in pnfs_layout_process()") switched the destination back to
free_me without restoring the drain.

Restore the pnfs_free_lseg_list() call.

The Linux kernel CVE team has assigned CVE-2026-89710 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.12.109 with commit 7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2
	Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.18.50 with commit 36e3f13bf0728f4ce11ee8904cec82a783222f62
	Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.2.4 with commit 32ac1b0b7f1cfa0d1a1faf9c72f4154046101070
	Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.3-rc1 with commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89710
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfs/pnfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2
	https://git.kernel.org/stable/c/36e3f13bf0728f4ce11ee8904cec82a783222f62
	https://git.kernel.org/stable/c/32ac1b0b7f1cfa0d1a1faf9c72f4154046101070
	https://git.kernel.org/stable/c/ee5a386cfe60f3f8286de16a9db8e1a08f0bc124