CVE-2026-23038: Linux Kernel pNFS Memory Leak Vulnerability

CVE-2026-23038 Overview

CVE-2026-23038 is a memory leak vulnerability in the Linux kernel's pnfs/flexfiles subsystem. The vulnerability exists in the nfs4_ff_alloc_deviceid_node() function where, if the allocation for ds_versions fails, the function incorrectly jumps to the out_scratch label without freeing the already allocated dsaddrs list. This improper resource cleanup leads to a memory leak condition that could potentially impact system stability over time.

Critical Impact

Memory leak in Linux kernel NFS pnfs/flexfiles subsystem can cause resource exhaustion and system instability in environments utilizing parallel NFS (pNFS) with flexible files layout.

Affected Products

• Linux Kernel (pnfs/flexfiles subsystem)

Discovery Timeline

• 2026-01-31 - CVE CVE-2026-23038 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23038

Vulnerability Analysis

This vulnerability affects the Linux kernel's parallel NFS (pNFS) flexible files layout driver. The nfs4_ff_alloc_deviceid_node() function is responsible for allocating and initializing device ID nodes used in pNFS flexible file layouts. During the allocation process, the function allocates multiple resources including a dsaddrs list and ds_versions structure.

The flaw occurs in the error handling path when the ds_versions allocation fails. Instead of properly cleaning up all previously allocated resources, the code jumps to the out_scratch label which does not free the dsaddrs list. Each time this error condition is triggered, memory allocated for the dsaddrs list is leaked.

In environments with heavy pNFS flexible files usage, repeated triggering of this condition could lead to gradual memory exhaustion, potentially causing system instability or denial of service conditions.

Root Cause

The root cause is improper error handling in the nfs4_ff_alloc_deviceid_node() function. When the ds_versions allocation fails, the function's error path incorrectly bypasses the cleanup code for the dsaddrs list. This is a classic resource management error where the error handling goto labels are not properly ordered to ensure all allocated resources are freed in reverse order of allocation.

Attack Vector

The attack vector for this vulnerability is local. An attacker with the ability to influence pNFS operations or trigger allocation failures could potentially exploit this memory leak. However, practical exploitation would require sustained triggering of the vulnerable code path to cause meaningful memory exhaustion. The vulnerability is primarily a reliability and stability concern rather than a direct security exploit vector.

The vulnerability manifests during NFS pNFS flexible files device ID node allocation. When memory allocation for the ds_versions structure fails, the cleanup path fails to properly release the dsaddrs list, resulting in leaked memory. For detailed technical analysis, see the kernel git commits referenced in this advisory.

Detection Methods for CVE-2026-23038

Indicators of Compromise

• Gradual increase in kernel memory usage without corresponding user-space activity
• Slab allocator memory growth in NFS-related caches
• Increased memory pressure or OOM killer activity on systems utilizing pNFS flexible files

Detection Strategies

• Monitor kernel memory allocation statistics via /proc/meminfo and /proc/slabinfo for unusual growth patterns
• Implement alerting on sustained memory growth in NFS subsystem memory pools
• Use kernel memory debugging tools like kmemleak to identify unreferenced memory allocations in pNFS code paths

Monitoring Recommendations

• Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in development and testing environments
• Monitor system memory usage trends on NFS servers and clients using pNFS flexible files
• Implement regular kernel version auditing to ensure patched versions are deployed

How to Mitigate CVE-2026-23038

Immediate Actions Required

• Apply the kernel patches from the stable branches as soon as possible
• Monitor memory usage on affected systems pending patch deployment
• Consider temporarily disabling pNFS flexible files layout if memory issues are observed

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix modifies the error handling in nfs4_ff_alloc_deviceid_node() to jump to the out_err_drain_dsaddrs label instead of out_scratch, ensuring the dsaddrs list is properly freed before cleaning up other resources.

Patches are available from the following kernel git commits:

• Kernel Git Commit 0c72808
• Kernel Git Commit 86986205
• Kernel Git Commit 86da7efd
• Kernel Git Commit ed5d3f2f

Workarounds

• Disable pNFS flexible files layout by mounting NFS shares without the pnfs option or using alternative layout types
• Implement memory monitoring and automatic service restart if memory thresholds are exceeded
• Schedule regular system reboots during maintenance windows to clear accumulated leaked memory

# Disable pNFS flexible files layout by remounting without pnfs option
mount -o remount,nopnfs /mnt/nfs_share

# Or explicitly use NFSv4.1 without flexible files layout
mount -t nfs4 -o vers=4.1,nolayout server:/export /mnt/nfs_share