Linux kernel nfsd: dangling IDR entry to freed layout stateid when nfsd4_layout_setlease() fails

Impact

nfs4_alloc_stid() publishes a new layout stateid into the client's IDR before nfsd4_layout_setlease() runs. On the setlease failure path the stateid is freed straight back to the slab without idr_remove(), so the IDR keeps a pointer to freed memory; any later walker - the states_show debugfs path or client teardown - dereferences it. A second defect means the delayed fence work is not initialised on that path either. Operators running an in-kernel NFS server with pNFS layouts in front of a GPU fleet get a use-after-free in the file server process context: realistic outcomes are a server-side panic that stalls every mounted client, with memory corruption not excluded. A single nfsd node going down takes the dataset mounts for many GPU nodes with it.

Who can reach it

An NFS client that can request a pNFS layout from the server and cause nfsd4_layout_setlease() to fail (conflicting leases or opens on the same file). Requires an authenticated NFS mount; no local access to the server is needed.

What to do

Apply the stable-kernel fix, which hoists the ls_fence_work initialisation above the setlease call and replaces the manual cleanup with nfs4_put_stid(). This is a kernel update on the NFS server: package upgrade plus reboot of the file server, or failover first if the server is clustered. Disabling pNFS layout exports removes the path if a reboot cannot be scheduled. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCVE-2026-63886 · Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCritical
• Linux kernel LIO iSCSI target: unbounded sprintf into the 8 KiB login response buffer overflows the heapCVE-2026-63887 · Linux kernel LIO iSCSI target (iscsi_encode_text_output login response buffer)Critical
• Linux kernel LIO iSCSI target: four-byte overread and text_in_ptr double-free in the Text PDU handlerCVE-2026-63888 · Linux kernel LIO iSCSI target (iscsit_handle_text_cmd DataDigest and text_in_ptr handling)Critical
• Linux kernel sockmap: missing kTLS guard in verdict data_ready leads to use-after-freeCVE-2026-64025 · Linux kernel sockmap/skmsg (sk_psock_verdict_data_ready vs kTLS RX)Critical
• Linux kernel (net/tls): A particular kTLS ring state builds a scatterlist whose chain link points directly at anotherCVE-2026-64046 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back toCVE-2026-64047 · Linux kernel (net/tls)Critical