CVE-2026-53399: nfsd: release layout stid on setlease failure

CVE-2026-53399: nfsd: release layout stid on setlease failure

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release layout stid on setlease failure

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.

A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.

    nfsd4_alloc_layout_stateid()
      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */
      nfsd4_layout_setlease()     /* fails */
        nfs4_put_stid()
          nfsd4_free_layout_stateid()
            delayed_work_pending(&ls->ls_fence_work)  /* needs INIT */
            nfsd4_close_layout()  /* nfsd_file_put(ls->ls_file) */
          put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).

The Linux kernel CVE team has assigned CVE-2026-53399 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.0 with commit c5c707f96fc9a6e5a57ca5baac892673270abe3d and fixed in 6.12.96 with commit d369e5edfaaf83a448016e2f1da392b2174be801
	Issue introduced in 4.0 with commit c5c707f96fc9a6e5a57ca5baac892673270abe3d and fixed in 6.18.39 with commit 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
	Issue introduced in 4.0 with commit c5c707f96fc9a6e5a57ca5baac892673270abe3d and fixed in 7.1.3 with commit 83c2b7797742339bb768f83935f7ca33950db138
	Issue introduced in 4.0 with commit c5c707f96fc9a6e5a57ca5baac892673270abe3d and fixed in 7.2-rc1 with commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-53399
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfsd/nfs4layouts.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801
	https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
	https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138
	https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9