CVE-2026-53399: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53399 Overview

CVE-2026-53399 is a use-after-free vulnerability in the Linux kernel NFS server (nfsd) subsystem. The flaw resides in nfsd4_alloc_layout_stateid(), where a failed nfsd4_layout_setlease() call leaves a dangling pointer inside the client's stateid IDR. Because nfs4_alloc_stid() publishes the new stateid via idr_alloc_cyclic() before setlease is attempted, the error path frees the object with kmem_cache_free() without calling idr_remove(). Subsequent IDR walkers such as states_show or client teardown then dereference freed slab memory. The vulnerability affects Linux kernel builds shipping the pNFS layout stateid code and is reachable remotely across NFSv4.1+ mounts.

Critical Impact
Remote attackers with NFS access can trigger a use-after-free in nfsd, enabling kernel memory corruption, denial of service, or potential code execution in kernel context.

Affected Products

Linux kernel versions containing the nfsd4_alloc_layout_stateid() setlease-failure path
Distributions shipping vulnerable stable kernels prior to the referenced fix commits
NFS servers exporting pNFS layouts to untrusted clients

Discovery Timeline

2026-07-19 - CVE-2026-53399 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-53399

Vulnerability Analysis

The vulnerability arises during layout stateid allocation in the NFSv4 server. nfs4_alloc_stid() inserts the freshly allocated stateid into cl->cl_stateids using idr_alloc_cyclic() under cl_lock. Control returns to nfsd4_alloc_layout_stateid(), which then calls nfsd4_layout_setlease(). When setlease fails, the error path releases the stateid directly with kmem_cache_free(). The IDR slot retains a pointer to that freed memory. Any later walker, including states_show in /proc and client teardown routines, dereferences the dangling pointer.

A secondary defect compounds the issue. nfsd4_free_layout_stateid() unconditionally calls delayed_work_pending(&ls->ls_fence_work) under ls_lock, but INIT_DELAYED_WORK() runs only after setlease succeeds. On the failure path the destructor touches uninitialized delayed_work state, producing further undefined behavior.

Root Cause

The root cause is inconsistent teardown of an IDR-published object. The correct destructor is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference. The original error path bypassed this contract and left the IDR referencing freed slab memory [CWE-416].

Attack Vector

A remote NFS client can trigger the setlease failure path by issuing pNFS LAYOUTGET operations under conditions that force vfs_setlease() to fail, such as conflicting locks on the exported file. Once the stateid is freed while still IDR-published, any subsequent operation that iterates the stateid table dereferences freed memory. The upstream fix hoists ls_fenced, ls_fence_delay, and INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replaces the manual nfsd_file_put + put_nfs4_file + kmem_cache_free sequence with a single nfs4_put_stid(stp) call.

Detection Methods for CVE-2026-53399

Indicators of Compromise

Kernel oops or panic reports referencing nfsd4_free_layout_stateid, states_show, or nfs4_put_stid in the call trace
KASAN use-after-free reports pointing at the nfsd4_layout_stateid slab cache
Unexpected NFS server crashes correlated with LAYOUTGET traffic from untrusted clients

Detection Strategies

Monitor dmesg and syslog for repeated nfsd warnings, BUG: messages, or slab corruption reports
Enable KASAN on test kernels to surface use-after-free access during NFS fuzzing
Inspect running kernel version against the stable fix commits 2e0a5d6d, 30d55c8a, 48a586e3, 7bbb7ce7, 83c2b779, 8dee7c27, d369e5ed, and d788ef40

Monitoring Recommendations

Alert on NFS server process restarts, kernel taint flag changes, and crash-dump generation
Track NFSv4 LAYOUTGET and LAYOUTRETURN error rates from individual clients for anomalous spikes
Correlate NFS export access logs with kernel crash telemetry to identify suspect clients

How to Mitigate CVE-2026-53399

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 2e0a5d6d, 30d55c8a, 48a586e3, 7bbb7ce7, 83c2b779, 8dee7c27, d369e5ed, and d788ef40
Update to distribution kernels that include the fix and reboot NFS server hosts
Restrict NFS export access to trusted client networks until patching completes

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the Kernel Git Commit 2e0a5d6d, Kernel Git Commit 30d55c8a, Kernel Git Commit 48a586e3, Kernel Git Commit 7bbb7ce7, Kernel Git Commit 83c2b779, Kernel Git Commit 8dee7c27, Kernel Git Commit d369e5ed, and Kernel Git Commit d788ef40 for the exact patch content across stable branches.

Workarounds

Disable pNFS layout support on affected servers where feasible by exporting without layout types
Restrict nfsd exposure to trusted subnets using host firewalls and NFS export ACLs
Migrate critical exports to patched hosts while unpatched servers remain reachable only from management VLANs

bash

# Verify kernel version and confirm fix presence
uname -r
git log --oneline | grep -E '2e0a5d6d|30d55c8a|48a586e3|7bbb7ce7|83c2b779|8dee7c27|d369e5ed|d788ef40'

# Restrict NFS exports to trusted subnet (example /etc/exports entry)
# /srv/nfs  10.0.0.0/24(rw,sync,no_subtree_check)
exportfs -ra