Executive brief
The Linux kernel's pNFS block layout device parser contains a memory leak bug that occurs when parsing configuration data for network block device structures fails. When a device parsing error occurs, allocated memory structures (child device arrays) are not properly released, causing leaked kernel memory. While this is a stability and resource exhaustion issue rather than a direct security bypass, repeated triggering of parse failures could degrade system performance or availability.
Technical details
This is a resource leak vulnerability in the pNFS (parallel NFS) block layout device parsing code (fs/nfs/blocklayout/dev.c). The root cause is in bl_parse_concat() and bl_parse_stripe() functions: when parsing child devices fails, the error path does not call bl_free_device() on partially-allocated child device arrays, leaving memory unreleased. Additionally, bl_parse_scsi() can leak file references when parsing fails after acquiring a bdev_file. The vulnerability requires local access to a system with pNFS block layout client code compiled in and an attacker must trigger device configuration parsing errors, typically by providing malformed device information. The fix ensures proper cleanup in error paths by explicitly freeing devices on parse failure and nullifying pointers after cleanup to prevent double-frees.
Affected products
- Linux Linux kernel All versions from 5.0 through 7.x (pNFS block layout support)
Timeline
- 2026-09-17: disclosed
- 2026-06-25: patched: Upstream commit c056f817e4200fb18079d5052c273a22f191ff0a