CVE-2026-23038

A memory leak is introduced in the Linux kernel’s pnfs/flexfiles subsystem when the function nfs4_ff_alloc_deviceid_node() fails to free the dsaddrs list after a memory allocation failure. Over repeated calls, the leaked kernel memory can accumulate, eventually exhausting available memory and causing system slowdown or a crash. The flaw does not provide code execution or privilege escalation directly; it simply corrupts resource accounting and can cause a denial of service that would require local or privileged access to trigger repeatedly.

This issue affects all Linux kernel releases that include the pnfs/flexfiles infrastructure. No specific version range is defined in the advisory, so any kernel that incorporates this subsystem is potentially impacted until the vendor distributes an updated image containing the patch.

The vulnerability carries a CVSS score of 7.0, indicating a serious impact. Its EPSS score is less than 1% and it is not listed in the CISA KEV catalog, suggesting that exploitation in the wild is unlikely. The flaw requires that an attacker can cause the failing allocation path to execute, which typically demands local or elevated privileges. If successfully exercised, the attacker could drain system memory and drive the host into an unusable state, but the risk remains bounded to denial of service rather than data compromise or code execution.