Executive brief
The Linux kernel's NFS version 4.1 file sharing implementation contains a memory leak in the layout segment processing code. When the server returns a new layout identifier while an old one is still active, layout segments are not properly freed from memory, gradually consuming system resources and potentially causing memory exhaustion and system instability on NFS clients.
Technical details
This is a resource leak vulnerability in the pnfs_layout_process() function within the NFSv4.1 (parallel NFS) implementation in fs/nfs/pnfs.c. The vulnerability occurs when a layout stateid transition triggers an early error path (out_forget) before successful layout processing. Layout segments whose reference count drops to zero are moved to a stack-allocated free_me list, but the error path fails to drain this list via pnfs_free_lseg_list(), leaving segments allocated in kernel memory indefinitely. The bug was introduced by commit fb700ef02676 which switched the destination list back to free_me but did not restore the necessary cleanup call. An attacker or malicious NFS server could trigger repeated layout transitions to accelerate memory exhaustion. The fix adds a single pnfs_free_lseg_list(&free_me) call to the error path.
Affected products
- Linux Linux kernel All versions with NFSv4.1 pnfs support (including linux-3.x, linux-4.x, linux-5.x, linux-6.x, linux-7.x)
Timeline
- 2026-09-11: disclosed
- 2026-08-16: patched