CVE-2026-89710

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

When the server returns a new layout stateid while a valid one is still

held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on

the on-stack free_me list and jumps to out_forget. Segments whose

reference count drops to zero are unlinked from lo->plh_segs and moved

to free_me by mark_lseg_invalid(); for an idle cached segment the layout

header holds the only reference, so this happens on the first decrement.

out_forget never drains free_me -- only the success path calls

pnfs_free_lseg_list().

Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in

pnfs_layout_process()") added the drain; commit 08bd8dbe8882

("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")

removed it while switching the destination to lo->plh_return_segs, which

is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout

return

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References