CVE-2026-53399

A use-after-free flaw was found in the Linux kernel's NFS daemon (nfsd) pNFS layout handling. When nfsd4_layout_setlease fails, the layout stateid that was already published in the client IDR is freed directly, leaving a stale pointer in the IDR. A subsequent IDR traversal, such as states_show or client teardown, can dereference this freed memory. An attacker with NFS client access to an exported filesystem with pNFS enabled could exploit this flaw to crash the kernel (Denial of Service) or potentially achieve privilege escalation or arbitrary code execution through kernel memory corruption by reclaiming the freed slab object with attacker-controlled data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.