CVE-2026-23038: Linux

EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak. Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.

Affected products

• Linux Linux: from 4.0, before 5.10.249 (fixed in 5.10.249); from 5.11, before 5.15.199 (fixed in 5.15.199); from 5.16, before 6.1.162 (fixed in 6.1.162); from 6.2, before 6.6.122 (fixed in 6.6.122); from 6.7, before 6.12.67 (fixed in 6.12.67); from 6.13, before 6.18.7 (fixed in 6.18.7)
• Siemens Ruggedcom RST2428P: before V4.0 (fixed in V4.0)
• Siemens SIMATIC s7-1500 CPU 1518-4 Pn/dp Mfp: from V3.1.6
• Siemens SIMATIC s7-1500 CPU 1518f-4 Pn/dp Mfp: from V3.1.6
• Siemens Siplus s7-1500 CPU 1518-4 Pn/dp Mfp: from V3.1.6

Published 2026-01-31. Last modified 2026-07-14.