Use-after-free in Linux kernel - CVE-2026-53399

Vulnerability identifier: #VU138859

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53399

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nfsd layout stateid handling in fs/nfsd/nfs4layouts.c when processing layout stateid allocation failures after a setlease error. A remote user can trigger a setlease failure and subsequent IDR walker access to dereference a dangling pointer to cause a denial of service.

The issue occurs because a published stateid remains referenced in the IDR after the associated memory is freed, and a related destructor path may access uninitialized delayed work on the same failure path.

Linux kernel
Debian Linux
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
openEuler
kernel (Red Hat package)
kernel-rt (Red Hat package)
bpftool-debuginfo
bpftool
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python2-perf
python2-perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel
kernel-headers
linux (Debian package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - addressed in versions 4.18.0-553.159.1.el8_10, 6.12.0-211.50.1.el10_2
kernel-rt (Red Hat package) - update to 4.18.0-553.159.1.rt7.500.el8_10
bpftool-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
bpftool - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-debugsource - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-devel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-source - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-tools - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-tools-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-tools-devel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
perf - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
perf-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
python2-perf - update to 4.19.90-2608.3.0.0385
python2-perf-debuginfo - update to 4.19.90-2608.3.0.0385
python3-perf - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
python3-perf-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-328.0.0.229
kernel-headers - update to 5.10.0-328.0.0.229
linux (Debian package) - update to 6.12.96-1

• https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9
• https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138
• https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
• https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801

• Use-after-free in Linux kernel nfsd
• Debian update for linux
• openEuler 22.03 LTS SP4 update for kernel
• openEuler 20.03 LTS SP4 update for kernel
• Red Hat Enterprise Linux 10 update for kernel
• Red Hat Enterprise Linux 8 update for kernel-rt
• Red Hat Enterprise Linux 8 update for kernel