CVE-2026-23038pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak. Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d67ae825a59d639e4d8b82413af84d854617a87e before e2dde5dafb80f1af4028ed10ad255f42af71c784; from d67ae825a59d639e4d8b82413af84d854617a87e before 27c90d8ed81e7a289c9fe41b5e31d8bb609a3385; from d67ae825a59d639e4d8b82413af84d854617a87e before 34b9dd179818ff7af2b36410985fd8166573c62d; from d67ae825a59d639e4d8b82413af84d854617a87e before 869862056e100973e76ce9f5f1b01837771b7722; from d67ae825a59d639e4d8b82413af84d854617a87e before 86da7efd12295a7e2b4abde5e5984c821edd938f; from d67ae825a59d639e4d8b82413af84d854617a87e before ed5d3f2f6885eb99f729e6ffd946e3aa058bd3eb; from d67ae825a59d639e4d8b82413af84d854617a87e before 0c728083654f0066f5e10a1d2b0bd0907af19a58 | CNA record |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V4.0 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
References
- https://git.kernel.org/stable/c/e2dde5dafb80f1af4028ed10ad255f42af71c784
- https://git.kernel.org/stable/c/27c90d8ed81e7a289c9fe41b5e31d8bb609a3385
- https://git.kernel.org/stable/c/34b9dd179818ff7af2b36410985fd8166573c62d
- https://git.kernel.org/stable/c/869862056e100973e76ce9f5f1b01837771b7722
- https://git.kernel.org/stable/c/86da7efd12295a7e2b4abde5e5984c821edd938f
- https://git.kernel.org/stable/c/ed5d3f2f6885eb99f729e6ffd946e3aa058bd3eb
- https://git.kernel.org/stable/c/0c728083654f0066f5e10a1d2b0bd0907af19a58
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.