CRITICAL Introduced in 3.18
nfs BlockDev Leak
CVE-2026-90150
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure bl_parse_concat() and bl_parse_stripe() allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nr_children and the parent may be left with a children array that bl_free_device() will not release when nr_children is zero. Release the failed child and the already parsed children before returning the error. Also make bl_free_device() release the child array whenever the children pointer is set, so that partially initialised concat or stripe devices are cleaned up correctly. bl_parse_scsi() can also fail after assigning d->bdev_file and dropping the file reference. Clear the pointer after fput() so that an outer cleanup path does not put it again.
02KernelScan AI Analysis
Risk summary
A malicious or compromised NFS server can send malformed pNFS block-layout device information to a client, causing kernel memory leaks and a double-release of file structure references on the client. This can lead to denial of service through memory exhaustion or, via the double-free on the file structure, potential privilege escalation. Any system mounting NFS shares with pNFS block layout support is affected.
Vulnerability analysis
When an NFS client that uses pNFS block layouts receives complex device layout information from the server, it builds a tree of child devices. If the server sends malformed data that causes parsing of one child to fail, the client used to abandon the work without releasing the already-created children or their container array, leaving that memory leaked in the kernel. Separately, if parsing of a SCSI-backed device fails after a block-device file has been opened and closed, the pointer was left set, so a later cleanup pass could close the same file again, causing a double-free. The fix now releases all partially-built children and their array before returning an error, makes the cleanup path free the array whenever it exists rather than relying on a child count, and clears the file pointer after closing so no second close can happen. Any system that has mounted an NFS share using pNFS block layouts can be affected; the attack comes from the server or a network man-in-the-middle, with no extra privileges needed on the client.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 3.18 | 6.12.110 | 8a2494964eda |
| 6.18 | 3.18 | 6.18.52 | 1e1c36b206c6 |
| 6.6 | 3.18 | 6.6.160 | 51d162dfb618 |
| 7.2 | 3.18 | 7.2.6 | 23e4162405c4 |
| mainline | 3.18 | 7.3 | c056f817e420 |
| cip/6.12 | 3.18 | 6.12.111-cip32 | 8a2494964eda |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |