CVE-2026-53399 - Vulnerability Details

- nfsd: release layout stid on setlease failure

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release layout stid on setlease failure

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.

A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.

nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s NFS server, a use‑after‑free occurs when the setlease operation fails. The routine allocates a layout state ID (stid) and publishes it via an IDR table, but on failure the code frees the stid without removing its IDR entry, leaving a dangling pointer. Subsequent IDR traversals dereference this freed memory, causing a use‑after‑free that can crash the server or potentially be leveraged for remote code execution. The flaw is a classic CWE‑825 issue related to memory management.

Affected Systems

The defect exists in the Linux kernel’s NFS subsystem and applies to all kernel releases built before the patch introduced in commit 30d55c8… (see the provided kernel links). All Linux distributions that ship a vulnerable kernel and run an NFS server are impacted. The flaw does not affect non‑NFS applications; it is limited to the NFS daemon.

Risk and Exploitability

The CVSS base score of 9.8 classifies the issue as critical. The EPSS rating of less than 1 % indicates a low current exploitation probability, and the vulnerability is not catalogued in CISA KEV. Based on the description, it is inferred that an attacker with network access to an NFS server that performs layout setlease calls could trigger the flaw. A failed setlease leads to a dangling IDR entry that can be dereferenced, resulting in a crash or, at a minimum, significant memory corruption that may be exploitable for remote code execution. No additional preconditions are enumerated in the advisory, so the primary mitigants are avoidance or patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< d788ef40a7517d22c97ab01700e4ae4c611b6f2f
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 7bbb7ce74051c8be4b69ff44ce3db370600dae61
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 48a586e382e4db1dbf958d44b63e081df5f8ed04
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< d369e5edfaaf83a448016e2f1da392b2174be801
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 83c2b7797742339bb768f83935f7ca33950db138
`c5c707f96fc9a6e5a57ca5baac892673270abe3d`	affected	< 30d55c8aabb261bc3f427d6b9aae7ef6206063f9

Linux

affected

Version	Status	Constraints
`4.0`	affected	—
`0`	unaffected	< 4.0
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,d369e5edfaaf83a448016e2f1da392b2174be801)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,83c2b7797742339bb768f83935f7ca33950db138)`	affected	code_commit	—
`[c5c707f96fc9a6e5a57ca5baac892673270abe3d,30d55c8aabb261bc3f427d6b9aae7ef6206063f9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.0`	affected	generic	—
`[0,4.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the NFS stateless IDR fix (see commit reference).
Restart the NFS service or reload the kernel module to ensure stale IDR entries are cleared.
If an immediate kernel upgrade is not feasible, restrict access to the NFS service to trusted hosts or implement firewall rules to limit external NFS traffic.

Generated by OpenCVE AI on July 30, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6393-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9
https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9
https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04
https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61
https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138
https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801
https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f
https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53399
https://www.cve.org/CVERecord?id=CVE-2026-53399

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9 https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04 https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61 https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53399 https://www.cve.org/CVERecord?id=CVE-2026-53399
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock / nfsd4_layout_setlease() / fails / nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) / needs INIT / nfsd4_close_layout() / nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).
Title		nfsd: release layout stid on setlease failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9 https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138 https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:00.055Z

Updated: 2026-08-05T12:35:38.736Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53399

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53399 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object