CVE-2026-53399

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= c5c707f96fc9a6e5a57ca5baac892673270abe3d < d788ef40a7517d22c97ab01700e4ae4c611b6f2f, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 7bbb7ce74051c8be4b69ff44ce3db370600dae61, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 48a586e382e4db1dbf958d44b63e081df5f8ed04, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < d369e5edfaaf83a448016e2f1da392b2174be801, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 83c2b7797742339bb768f83935f7ca33950db138, >= c5c707f96fc9a6e5a57ca5baac892673270abe3d < 30d55c8aabb261bc3f427d6b9aae7ef6206063f9, >= 4.0, >= 4.0 < 5.10.261, >= 5.11 < 5.15.212, >= 5.16 < 6.1.178, >= 6.2 < 6.6.145, >= 6.7 < 6.12.96, >= 6.13 < 6.18.39, >= 6.19 < 7.1.3

Fixed versions

5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-476