SB20260815163 - Improper resource shutdown or release in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-74316)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nfsd4_drop_revoked_stid() when processing FREE_STATEID for an admin-revoked layout stateid. A remote user can send a crafted FREE_STATEID request to cause a denial of service.

The affected stateid remains in the IDR and on the per-client list until the client is destroyed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7ed62f7040ee182cf7dea5798f9e114235b31dae
• https://git.kernel.org/stable/c/8024028ef91616cf91cc669f2446a0406bc0ba19
• https://git.kernel.org/stable/c/86b9898920a6d02b4149f4fef9efd77b8aa3b9ca
• https://git.kernel.org/stable/c/da6f86ff4f2dd490bea52419a49e19680efd5847