NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-89710

NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

Answer in brief

CVE-2026-89710 records a Unknown severity vulnerability in NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=fb700ef026766c95578aafc0db1b208946e7ad4f <7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2 \|\| >=fb700ef026766c95578aafc0db1b208946e7ad4f <36e3f13bf0728f4ce11ee8904cec82a783222f62 \|\| >=fb700ef026766c95578aafc0db1b208946e7ad4f <32ac1b0b7f1cfa0d1a1faf9c72f4154046101070 \|\| >=fb700ef026766c95578aafc0db1b208946e7ad4f <ee5a386cfe60f3f8286de16a9db8e1a08f0bc124	7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2, 36e3f13bf0728f4ce11ee8904cec82a783222f62, 32ac1b0b7f1cfa0d1a1faf9c72f4154046101070, ee5a386cfe60f3f8286de16a9db8e1a08f0bc124
Linux/Linuxgeneric	5.13	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement. out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list(). Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()") removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()") switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list() call.

Quoted source text, attributed separately from HOL analysis.