From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F6A445C70F for ; Fri, 11 Sep 2026 20:03:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157027; cv=none; b=OKbazmDaeZ0s5S/hmtW15ysXezfTGCQuSiDpz3dHBn5gxKq+443WRwaMzKLyoJoVKBNiIQEUxLcOQyecCJZQbwVqRykQopOMb3I07dM2hHtr9Bn9A2lIVVyVvB0mT/QQnuB2prSJdYDEgz3D8Zd8YymbTgV4d1H8tWYWFiHJSVw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157027; c=relaxed/simple; bh=HSypGaKGPKC+oq9bowTjI6hj7LhZRz3zoJMniunuHMM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jcA+8lJk7UgoSfaWvmBjzA7Z+ASlKOzj2MjYQoHFglVyNGUJX9DQ8Tj5BWbpFjQUOi/cnFNN0KpF8W8pbFK/ZNB4KUT3q9XB5Oop8TXo/Y2ypY+tb6/67YWiHvZbzmNf3gsabnQFA5V8PEIeee4HqcFt+nGzka7QSr3aiQfcqvI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BPYFWQyd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="BPYFWQyd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69CDB1F000FF; Fri, 11 Sep 2026 20:03:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789157019; bh=6dvGJCaIOX8Yfan7ncSQj1/5gSJ8eVpiW7fdxOGIHq4=; h=From:To:Cc:Subject:Date:Reply-To; b=BPYFWQydLE345SNYyENBb8A+4eKhypzAvYPjx8fqEhGjq1YkqbaAIjjpL6OZMkCjL hTqKmgg8k0Q2Zzab7SiVG2FMd22cX6aoEFgtSpBN/SHGX6zbf6Ua+4Y4t4VFJ5Sgmy iwFu8yaayAN9ZFXRiq+NM+/KOYAJ3c70U7kVLOsA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Date: Fri, 11 Sep 2026 21:46:39 +0200 Message-ID: <2026091157-CVE-2026-89710-667f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3243; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=wPC5VqEFU+puJGf63as5e+86CPDto9VCnwNzvpQWFbY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIls/bHo0P0k4Oziqoubk9H0PJhxNc+ZYkyz92+d6w eGMD3WFHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR+SYMC5a1rTwm/uZfbmT/ CjMZ5TLHSVOtNjEs6L6nsL3i4OLv6lHC+5+YsM5bmBWgBgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement. out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list(). Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()") removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()") switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list() call. The Linux kernel CVE team has assigned CVE-2026-89710 to this issue. Affected and fixed versions =========================== Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.12.109 with commit 7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2 Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 6.18.50 with commit 36e3f13bf0728f4ce11ee8904cec82a783222f62 Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.2.4 with commit 32ac1b0b7f1cfa0d1a1faf9c72f4154046101070 Issue introduced in 5.13 with commit fb700ef026766c95578aafc0db1b208946e7ad4f and fixed in 7.3-rc1 with commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89710 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfs/pnfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2 https://git.kernel.org/stable/c/36e3f13bf0728f4ce11ee8904cec82a783222f62 https://git.kernel.org/stable/c/32ac1b0b7f1cfa0d1a1faf9c72f4154046101070 https://git.kernel.org/stable/c/ee5a386cfe60f3f8286de16a9db8e1a08f0bc124