CVE-2026-89710: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89710 Overview

CVE-2026-89710 is a memory leak vulnerability in the Linux kernel's NFSv4.1 parallel NFS (pNFS) implementation. The flaw resides in the pnfs_layout_process() function, which fails to drain the on-stack free_me list on its out_forget error path. When the NFS server returns a new layout stateid while a valid one is still held, layout segments unlinked by mark_lseg_invalid() are moved to free_me but never released, leaking kernel memory tied to layout state.

Critical Impact
Repeated triggering of the forget path against an NFSv4.1 client causes kernel memory exhaustion, degrading NFS client stability over time and enabling a local denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel NFSv4.1 client with pNFS layout support enabled
Distributions shipping kernels that include commit fb700ef02676 without the restored drain
Downstream vendor kernels rebased on the affected upstream branches

Discovery Timeline

2026-09-11 - CVE-2026-89710 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89710

Vulnerability Analysis

The vulnerability is a memory leak in the parallel NFS (pNFS) layout processing path of the Linux kernel NFSv4.1 client. When pnfs_layout_process() receives a new layout stateid while a valid one is still held, it invokes pnfs_mark_matching_lsegs_return() against a stack-local free_me list, then jumps to the out_forget label. Segments whose reference count reaches zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(). For an idle cached segment the layout header holds the only reference, so the segment lands on free_me on the first decrement.

The out_forget path never calls pnfs_free_lseg_list() on that list. Only the success path drains it, so any segment placed on free_me during error handling remains allocated. Over time this consumes non-reclaimable kernel memory tied to layout state.

Root Cause

The defect is a regression introduced by commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()"), which switched the destination back to free_me without restoring the drain that had been added in commit 814b84971388 and later removed in commit 08bd8dbe8882. The fix restores the pnfs_free_lseg_list() invocation on the out_forget path so freed segments are properly released.

Attack Vector

Triggering the leak requires the NFSv4.1 client to receive a new layout stateid from the server while holding a valid one. This is a legitimate protocol condition that a malicious or misbehaving NFS server can induce repeatedly, or that can occur naturally in high-churn pNFS deployments. Each occurrence permanently strands pnfs_layout_segment allocations in kernel memory, gradually exhausting slab resources.

The vulnerability does not provide code execution or privilege escalation. Exploitation requires an NFSv4.1 mount to a server capable of returning layout stateids, and the impact is limited to resource exhaustion and NFS subsystem instability.

No verified public exploit code is available. See the upstream fix commits for the precise change: Linux Kernel Commit a080bb69 and Linux Kernel Commit f5218811.

Detection Methods for CVE-2026-89710

Indicators of Compromise

Growth in the nfs_page and pNFS layout segment slab caches visible in /proc/slabinfo on NFSv4.1 clients without a corresponding increase in active NFS I/O.
Steady increase in kernel Slab and SUnreclaim values in /proc/meminfo on hosts with long-lived NFSv4.1 mounts.
NFS client warnings or soft lockups tied to layout state accumulation after extended uptime.

Detection Strategies

Track the installed kernel package version against distribution security advisories referencing CVE-2026-89710 and the upstream commit hashes listed above.
Use crash or drgn to walk nfs_client and pnfs_layout_hdr structures on suspect hosts and quantify orphaned pnfs_layout_segment entries.
Correlate NFSv4.1 server logs showing frequent layout stateid reissuance with client-side slab growth.

Monitoring Recommendations

Baseline kernel slab consumption on NFSv4.1 clients and alert on sustained upward drift that does not correlate with workload changes.
Monitor dmesg for NFS layout-related warnings and pNFS state transitions.
Inventory NFSv4.1 clients and their kernel versions so patch status can be evaluated when advisories are released.

How to Mitigate CVE-2026-89710

Immediate Actions Required

Identify Linux hosts running NFSv4.1 with pNFS enabled and prioritize them for kernel updates that incorporate the upstream fix.
Schedule reboots for long-uptime NFS clients showing abnormal slab growth to reclaim leaked layout segments.
Restrict NFSv4.1 mounts to trusted servers to reduce exposure to servers that may abusively churn layout stateids.

Patch Information

The fix restores the pnfs_free_lseg_list(&free_me) call on the out_forget path in fs/nfs/pnfs.c. Apply vendor kernel updates that include one of the following upstream commits: 32ac1b0b, 36e3f13b, 7c5b0e81, a080bb69, ad3e4185, ee5a386c, or f5218811.

Workarounds

Where feasible, mount NFS shares using NFSv4.0 or NFSv3, which are not affected by the pNFS layout processing path.
Disable pNFS layout usage on affected clients if the workload does not require it, forcing standard NFSv4.1 I/O.
Rotate or reboot long-running NFSv4.1 clients periodically to release accumulated leaked layout segments until patched kernels are deployed.

bash

# Example: mount an NFS share without pNFS layout usage as a temporary workaround
mount -t nfs -o vers=4.1,nolock,noac,minorversion=1 \
    server.example.com:/export /mnt/nfs

# Verify kernel version after patching
uname -r

# Inspect pNFS-related slab caches for signs of leak growth
grep -E 'nfs_page|pnfs' /proc/slabinfo