CVE-2026-53399

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release layout stid on setlease failure

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via

idr_alloc_cyclic() under cl_lock before returning to

nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then

fails, the error path frees the layout stateid directly with

kmem_cache_free() without ever calling idr_remove(), leaving the

IDR slot pointing at freed slab memory. Any subsequent IDR walker

(states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(),

which removes the IDR slot under cl_lock, dispatches sc_free

(nfsd4_free_layout_stateid) to release ls->ls_file via

nfsd4_close_layout(), and drops the nfs4_file reference in its

tail.

A second issue blocks that switch: nfsd4_free_layout_stateid()

unconditionally inspects ls->ls_fence_work via

delayed_work_pending() under ls_lock, but

INIT_DELAYED_WORK(&ls->ls_fence_work,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References