From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Date: Fri, 11 Sep 2026 21:46:39 +0200 [thread overview]
Message-ID: <2026091157-CVE-2026-89710-667f@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
When the server returns a new layout stateid while a valid one is still
held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
the on-stack free_me list and jumps to out_forget. Segments whose
reference count drops to zero are unlinked from lo->plh_segs and moved
to free_me by mark_lseg_invalid(); for an idle cached segment the layout
header holds the only reference, so this happens on the first decrement.
out_forget never drains free_me -- only the success path calls
pnfs_free_lseg_list().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in
pnfs_layout_process()") added the drain; commit 08bd8dbe8882
("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")
removed it while switching the destination to lo->plh_return_segs, which
is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout
return in pnfs_layout_process()") switched the destination back to
free_me without restoring the drain.
Restore the pnfs_free_lseg_list() call.
The Linux kernel CVE team has assigned CVE-2026-89710 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.12.109 with commit 7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2
Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.18.50 with commit 36e3f13bf0728f4ce11ee8904cec82a783222f62
Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.2.4 with commit 32ac1b0b7f1cfa0d1a1faf9c72f4154046101070
Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.3-rc1 with commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-89710
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
fs/nfs/pnfs.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2
https://git.kernel.org/stable/c/36e3f13bf0728f4ce11ee8904cec82a783222f62
https://git.kernel.org/stable/c/32ac1b0b7f1cfa0d1a1faf9c72f4154046101070
https://git.kernel.org/stable/c/ee5a386cfe60f3f8286de16a9db8e1a08f0bc124
reply other threads:[~2026-09-11 20:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091157-CVE-2026-89710-667f@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox