CVE-2026-23038: Linux Kernel pNFS Memory Leak Vulnerability

CVE-2026-23038 Overview

CVE-2026-23038 is a memory leak vulnerability in the Linux kernel's pnfs/flexfiles subsystem. The vulnerability exists in the nfs4_ff_alloc_deviceid_node() function where, if the allocation for ds_versions fails, the function incorrectly jumps to the out_scratch label without freeing the already allocated dsaddrs list. This improper resource cleanup leads to a memory leak condition that could potentially impact system stability over time.

Critical Impact
Memory leak in Linux kernel NFS pnfs/flexfiles subsystem can cause resource exhaustion and system instability in environments utilizing parallel NFS (pNFS) with flexible files layout.

Affected Products

Linux Kernel (pnfs/flexfiles subsystem)

Discovery Timeline

2026-01-31 - CVE CVE-2026-23038 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23038

Vulnerability Analysis

This vulnerability affects the Linux kernel's parallel NFS (pNFS) flexible files layout driver. The nfs4_ff_alloc_deviceid_node() function is responsible for allocating and initializing device ID nodes used in pNFS flexible file layouts. During the allocation process, the function allocates multiple resources including a dsaddrs list and ds_versions structure.

The flaw occurs in the error handling path when the ds_versions allocation fails. Instead of properly cleaning up all previously allocated resources, the code jumps to the out_scratch label which does not free the dsaddrs list. Each time this error condition is triggered, memory allocated for the dsaddrs list is leaked.

In environments with heavy pNFS flexible files usage, repeated triggering of this condition could lead to gradual memory exhaustion, potentially causing system instability or denial of service conditions.

Root Cause

The root cause is improper error handling in the nfs4_ff_alloc_deviceid_node() function. When the ds_versions allocation fails, the function's error path incorrectly bypasses the cleanup code for the dsaddrs list. This is a classic resource management error where the error handling goto labels are not properly ordered to ensure all allocated resources are freed in reverse order of allocation.

Attack Vector

The attack vector for this vulnerability is local. An attacker with the ability to influence pNFS operations or trigger allocation failures could potentially exploit this memory leak. However, practical exploitation would require sustained triggering of the vulnerable code path to cause meaningful memory exhaustion. The vulnerability is primarily a reliability and stability concern rather than a direct security exploit vector.

The vulnerability manifests during NFS pNFS flexible files device ID node allocation. When memory allocation for the ds_versions structure fails, the cleanup path fails to properly release the dsaddrs list, resulting in leaked memory. For detailed technical analysis, see the kernel git commits referenced in this advisory.

Detection Methods for CVE-2026-23038

Indicators of Compromise

Gradual increase in kernel memory usage without corresponding user-space activity
Slab allocator memory growth in NFS-related caches
Increased memory pressure or OOM killer activity on systems utilizing pNFS flexible files

Detection Strategies

Monitor kernel memory allocation statistics via /proc/meminfo and /proc/slabinfo for unusual growth patterns
Implement alerting on sustained memory growth in NFS subsystem memory pools
Use kernel memory debugging tools like kmemleak to identify unreferenced memory allocations in pNFS code paths

Monitoring Recommendations

Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in development and testing environments
Monitor system memory usage trends on NFS servers and clients using pNFS flexible files
Implement regular kernel version auditing to ensure patched versions are deployed

How to Mitigate CVE-2026-23038

Immediate Actions Required

Apply the kernel patches from the stable branches as soon as possible
Monitor memory usage on affected systems pending patch deployment
Consider temporarily disabling pNFS flexible files layout if memory issues are observed

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix modifies the error handling in nfs4_ff_alloc_deviceid_node() to jump to the out_err_drain_dsaddrs label instead of out_scratch, ensuring the dsaddrs list is properly freed before cleaning up other resources.

Patches are available from the following kernel git commits:

Workarounds

Disable pNFS flexible files layout by mounting NFS shares without the pnfs option or using alternative layout types
Implement memory monitoring and automatic service restart if memory thresholds are exceeded
Schedule regular system reboots during maintenance windows to clear accumulated leaked memory

bash

# Disable pNFS flexible files layout by remounting without pnfs option
mount -o remount,nopnfs /mnt/nfs_share

# Or explicitly use NFSv4.1 without flexible files layout
mount -t nfs4 -o vers=4.1,nolayout server:/export /mnt/nfs_share