CVE-2026-23038 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
A memory leak in the Linux kernel's NFS flexfiles driver allows remote attackers to cause a denial of service by exhausting system memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23038?
CVE-2026-23038 is a denial of service vulnerability in Linux, published on 31 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.
Weakness: CWE-401
Which versions are affected by CVE-2026-23038?
How do I fix CVE-2026-23038?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23038 being exploited?
There is no known exploitation of CVE-2026-23038 in the wild and no public exploit code.
Sources
Also known as AZL-77154, BELL-CVE-2026-23038, DEBIAN-CVE-2026-23038, GHSA-96c4-w7rm-2mx2, ROOT-OS-DEBIAN-11-CVE-2026-23038, ROOT-OS-DEBIAN-12-CVE-2026-23038 and 4 more.