CVE-2026-89710

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: fix layout segment leak on the pnfs layout process() forget path

When the server returns a new layout stateid while a valid one is still held, pnfs layout process() calls pnfs mark matching lsegs return() on the on-stack free me list and jumps to out forget. Segments whose reference count drops to zero are unlinked from lo->plh segs and moved to free me by mark lseg invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement.

out forget never drains free me -- only the success path calls pnfs free lseg list().

Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in pnfs layout process()") added the drain; commit 08bd8dbe8882 ("pNFS/NFSv4: Try to return invalid layout in pnfs layout process()") removed it while switching the destination to lo->plh return segs, which is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs layout process()") switched the destination back to free me without restoring the drain.

Restore the pnfs free lseg list() call.