CVE-2026-23038CWE-401

CVE-2026-23038

published January 31, 2026

CVSS
—
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()

In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,

the function jumps to the out_scratch label without freeing the already

allocated dsaddrs list, leading to a memory leak.

Fix this by jumping to the out_err_drain_dsaddrs label, which properly

frees the dsaddrs list before cleaning up other resources.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-01-31T17:16Z
References (10)
EPSS history
Timeline
  • 31 JAN 11:42Z
    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
    cvelistv5