CVE-2026-53399 - Vulnerability Details

- nfsd: release layout stid on setlease failure

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release layout stid on setlease failure

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.

A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.

nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s NFS server contains a use‑after‑free vulnerability that is triggered when a layout setlease operation fails. During allocation a state ID is registered in an IDR table, but the failure path frees the object without removing its IDR entry, leaving a dangling pointer. Subsequent IDR traversal can dereference this freed memory, causing a crash or memory corruption. The description does not confirm that arbitrary code execution is possible, but the severity of the flaw could allow an attacker to induce a denial of service or potentially leverage the corrupted state for more advanced compromise.

Affected Systems

The defect resides in the NFS subsystem of the Linux kernel and applies to all kernel releases built before the patch introduced in commit 30d55c8. Any Linux distribution shipping a vulnerable kernel and operating an NFS server is impacted. The flaw does not affect non‑NFS applications and is limited to the NFS daemon.

Risk and Exploitability

The CVSS base score of 9.8 classifies the issue as critical. The EPSS rating of less than 1 % suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary that can target an NFS server over the network to trigger a setlease failure, either by malformed requests or by exhausting resources, thereby exposing the use‑after‑free condition. No additional preconditions are enumerated in the advisory, so the primary mitigants are avoidance or patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< d788ef40a7517d22c97ab01700e4ae4c611b6f2f
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 7bbb7ce74051c8be4b69ff44ce3db370600dae61
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 48a586e382e4db1dbf958d44b63e081df5f8ed04
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< d369e5edfaaf83a448016e2f1da392b2174be801
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 83c2b7797742339bb768f83935f7ca33950db138
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 30d55c8aabb261bc3f427d6b9aae7ef6206063f9

Linux

affected

Version	Status	Constraints
`4.0`	affected	—
`0`	unaffected	< 4.0
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,d369e5edfaaf83a448016e2f1da392b2174be801)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,83c2b7797742339bb768f83935f7ca33950db138)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,30d55c8aabb261bc3f427d6b9aae7ef6206063f9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.0`	affected	generic	—
`[0,4.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the NFS stateless IDR fix (see commit reference).
Restart the NFS service or reload the kernel module to ensure stale IDR entries are cleared.
If an immediate kernel upgrade is not feasible, restrict access to the NFS service to trusted hosts or implement firewall rules to limit external NFS traffic.

Generated by OpenCVE AI on October 23, 2026 at 00:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6393-1	linux security update
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00663.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9
https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9
https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04
https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61
https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138
https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801
https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f
https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53399
https://www.cve.org/CVERecord?id=CVE-2026-53399

History

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9 https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04 https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61 https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53399 https://www.cve.org/CVERecord?id=CVE-2026-53399
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock / nfsd4_layout_setlease() / fails / nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) / needs INIT / nfsd4_close_layout() / nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).
Title		nfsd: release layout stid on setlease failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9 https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138 https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:00.055Z

Updated: 2026-10-19T20:07:46.712Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53399

Vulnrichment

No data.

NVD

Status : Modified

Published: 2026-07-19T12:16:51.063

Modified: 2026-10-19T20:19:18.683

Link: CVE-2026-53399

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53399 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:30:08Z

Weaknesses

CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object