CVE-2026-53399

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory management issue exists in the nfsd component. When nfsd4 layout setlease() fails, the error path incorrectly frees the layout stateid using kmem cache free() without calling idr remove(). This leaves an IDR slot pointing to freed slab memory, causing subsequent IDR walkers, such as states show or client teardown, to dereference a dangling pointer. Additionally, the nfsd4 free layout stateid() function may attempt to inspect ls->ls fence work via delayed work pending() before it has been initialized, as the initialization previously occurred after the setlease call.

Recommendations Update the Linux kernel to a version where the ls fenced, ls fence delay, and INIT DELAYED WORK initializations are moved above the nfsd4 layout setlease() call, and the manual cleanup process is replaced with the nfs4 put stid() function.