CVE-2026-23038: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23038 is a memory leak vulnerability in the Linux kernel's pNFS/flexfiles subsystem, specifically within the nfs4_ff_alloc_deviceid_node() function. When the allocation for ds_versions fails, the function incorrectly jumps to the out_scratch label without freeing the already-allocated dsaddrs list, resulting in a kernel memory leak that can lead to denial of service. The vulnerability was published on January 31, 2026, and affects Linux kernel versions from commit d67ae825a59d up to the respective fix commits across stable branches. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.018% (Red Hat Bugzilla, Feedly).

The root cause is improper resource cleanup on an error path in nfs4_ff_alloc_deviceid_node() within the pNFS flexfiles driver (CWE-401: Missing Release of Memory after Effective Lifetime). When ds_versions memory allocation fails, the error-handling code jumps to out_scratch instead of out_err_drain_dsaddrs, bypassing the deallocation of the previously allocated dsaddrs list. The fix redirects the error jump to out_err_drain_dsaddrs, which properly frees the dsaddrs list before releasing other resources. This is a local kernel-level issue triggered during NFS device ID node allocation, requiring conditions where pNFS flexfiles is in use and memory allocation fails (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a kernel memory leak within the pNFS/flexfiles subsystem, which over time can exhaust kernel memory and lead to a denial of service condition on affected systems. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems acting as NFS clients using the pNFS flexfiles layout driver are the primary affected assets (Red Hat Bugzilla, Feedly).

The fix has been applied to multiple Linux kernel stable branches. Patched versions include Linux 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6, with corresponding upstream commits (869862056e10, 86da7efd1229, ed5d3f2f6885, 0c728083654f). Downstream distributions including Ubuntu (USN-8162-1, USN-8180-x series, USN-8275-1, USN-8278-x, USN-8289-x, USN-8296-x, USN-8297-x), SUSE, Oracle Linux, and Amazon Linux 2 have issued kernel updates. Administrators should apply the latest kernel updates from their respective distribution vendors. As a temporary workaround where patching is not immediately possible, disabling pNFS flexfiles layout usage can mitigate the risk (Red Hat Bugzilla, Ubuntu USN-8162-1).

The vulnerability has been tracked by major Linux distribution vendors including Red Hat, Ubuntu, SUSE, Oracle, and Amazon Linux, all of which have issued kernel security updates addressing this and related issues. Red Hat's Bugzilla entry classifies the severity as medium and notes the upstream advisory was published via the linux-cve-announce mailing list. No notable independent researcher commentary or significant social media discussion has been identified for this low-severity memory leak fix (Red Hat Bugzilla).