PT-2026-61104 · Linux · Linux
CVE-2026-53399
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release layout stid on setlease failure
nfs4 alloc stid() publishes the new stid into cl->cl stateids via
idr alloc cyclic() under cl lock before returning to
nfsd4 alloc layout stateid(). When nfsd4 layout setlease() then
fails, the error path frees the layout stateid directly with
kmem cache free() without ever calling idr remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4 put stid(),
which removes the IDR slot under cl lock, dispatches sc free
(nfsd4 free layout stateid) to release ls->ls file via
nfsd4 close layout(), and drops the nfs4 file reference in its
tail.
A second issue blocks that switch: nfsd4 free layout stateid()
unconditionally inspects ls->ls fence work via
delayed work pending() under ls lock, but
INIT DELAYED WORK(&ls->ls fence work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed work.
nfsd4 alloc layout stateid()
nfs4 alloc stid() /* idr alloc cyclic under cl lock /
nfsd4 layout setlease() / fails /
nfs4 put stid()
nfsd4 free layout stateid()
delayed work pending(&ls->ls fence work) / needs INIT /
nfsd4 close layout() / nfsd file put(ls->ls file) */
put nfs4 file()
Fix by hoisting the ls fenced / ls fence delay / INIT DELAYED WORK
initialization above the nfsd4 layout setlease() call, and replace
the manual nfsd file put + put nfs4 file + kmem cache free cleanup
with a single nfs4 put stid(stp).
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux