CVE-2026-53399 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems should be aware of this vulnerability and take necessary actions to ensure their systems are updated with the patched kernel. They should verify the patched kernel, monitor system logs for potential exploitation attempts, and review compensating controls for exposed systems.

Technical summary

The vulnerability is caused by the failure of nfsd4_layout_setlease() to release the layout stid, leading to a dangling pointer in the IDR slot. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference. This issue can be resolved by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call and replacing the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

Defensive priority

High

Recommended defensive actions

• Update Linux kernel to the latest version
• Verify and apply patches for nfsd4_alloc_layout_stateid() and nfsd4_layout_setlease()
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-19T12:16:51.063Z and has not been modified since then. The NVD entry is currently Received. There is no additional information available about the vulnerability beyond what is provided in the CVE record and NVD entry. The Linux kernel vulnerability, CVE-2026-53399, was resolved by releasing layout stid on setlease failure. The nfsd4_alloc_layout_stateid() function publishes a new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_layout_setlease(). When nfsd4_layout_setlease() fails, the error path frees the layout stateid directly with kmem_cache_free() without calling idr_remove(), leaving the IDR slot pointing at freed slab memory. System administrators and security teams should verify the patched kernel and monitor system logs for potential exploitation attempts.

Official resources