CVE-2026-23038 — Missing Release of Resource after Effective Lifetime in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 94.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 31
Latest updateApr 17
Description
In the Linux kernel, the following vulnerability has been resolved:
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,
the function jumps to the out_scratch label without freeing the already
allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly
frees the dsaddrs list before cleaning up other resources.
Affected Packages12 packages
▶CVEListV5linux/linuxd67ae825a59d639e4d8b82413af84d854617a87e — e2dde5dafb80f1af4028ed10ad255f42af71c784+7
🔴Vulnerability Details
3GHSA▶
GHSA-96c4-w7rm-2mx2: In the Linux kernel, the following vulnerability has been resolved:
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In nfs4_ff_allo↗2026-01-31
OSV▶
CVE-2026-23038: In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_↗2026-01-31