CVE-2026-74316

Received Received - Intake

Memory Leak in Linux Kernel NFSD Layout State Handling

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or releasing the stid. The stid remains in the IDR and on the per-client list until the client is destroyed. Remove the layout stid from the per-client list and call nfs4_put_stid() to drop the creation reference. When the refcount reaches zero, nfsd4_free_layout_stateid() handles the remaining cleanup: cancelling the fence worker, removing from the per-file list, and freeing the slab object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74316

EUVD

EUVD-2026-59463

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of layout state IDs in the NFS server (NFSD). When a client sends a FREE_STATEID request for an admin-revoked layout state ID, the system fails to properly release the state ID. This causes the state ID to remain in memory and linked to the client until the client is destroyed, potentially leading to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS daemon (NFSD) and requires kernel-level inspection. Detection involves checking kernel logs for related errors or monitoring NFS stateid handling. Commands like dmesg, journalctl -k, or checking nfsd-related processes may help identify unusual behavior.

Impact Analysis

This vulnerability could lead to resource exhaustion on the system running the vulnerable Linux kernel. Specifically, memory and other system resources may be consumed by unreleased state IDs, potentially causing performance degradation or system instability over time.

Compliance Impact

The provided CVE does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves improper handling of layout state IDs in the Linux kernel's NFS server, which could lead to resource leaks but lacks details on data exposure or privacy implications required for compliance assessments.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Restart the nfsd service after updating. Monitor NFS operations for unexpected stateid leaks or crashes. Ensure client systems are also updated to avoid triggering the flaw.

Hi! I’m here to help you understand CVE-2026-74316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70