CVE-2026-74316 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or releasing the stid. The stid remains in the IDR and on the per-client list until the client is destroyed.
Remove the layout stid from the per-client list and call nfs4_put_stid() to drop the creation reference. When the refcount reaches zero, nfsd4_free_layout_stateid() handles the remaining cleanup: cancelling the fence worker, removing from the per-file list, and freeing the slab object.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's NFSD subsystem represents a critical resource management flaw that could lead to persistent state identifier leaks within the NFS server implementation. This issue specifically affects the nfsd4_drop_revoked_stid() function which handles cleanup operations for revoked state identifiers. The problem manifests when administrative revocation occurs on layout state identifiers, creating a scenario where certain state management paths are not properly executed due to missing case handling in the switch statement structure.
The technical flaw stems from the absence of an SC_TYPE_LAYOUT case within the nfsd4_drop_revoked_stid() function implementation. When a client submits a FREE_STATEID request for an admin-revoked layout stid, the function falls through to its default branch which incorrectly handles the cleanup process. This improper handling results in critical resource management operations being omitted including the unhashing of the state identifier and proper removal from the per-client state tracking lists. The consequence is that while the lock is released, the state identifier remains permanently resident in the internal IDR (Integer Descriptor Repository) data structure and continues to appear on the per-client state list until the client connection is ultimately terminated.
This vulnerability creates a persistent denial of service condition by consuming kernel memory resources unnecessarily and potentially affecting system stability over extended periods. The improper cleanup behavior violates fundamental resource management principles and creates an opportunity for attackers to exhaust available memory resources through repeated exploitation of this state leak pattern. The impact extends beyond simple resource consumption as it affects the integrity of the NFS server's internal state tracking mechanisms, potentially leading to unpredictable behavior in concurrent access scenarios.
The resolution strategy involves implementing proper cleanup operations for layout state identifiers by explicitly removing them from per-client lists and invoking the appropriate reference counting mechanism through nfs4_put_stid(). This approach ensures that when the reference count reaches zero, the specialized cleanup function nfsd4_free_layout_stateid() automatically handles all remaining resource deallocation tasks including cancellation of fence worker threads, removal from per-file state tracking lists, and final slab memory deallocation. The fix aligns with established security practices for kernel memory management and addresses the core issue identified in CWE-404, which concerns improper resource release or cleanup operations. This remediation approach follows ATT&CK technique T1499.002 for defensive measures related to resource exhaustion attacks and demonstrates proper implementation of reference counting patterns within kernel space code.
The vulnerability classification places this issue within the domain of kernel memory management failures that could be exploited by malicious actors to consume system resources or potentially cause system instability through sustained exploitation. Proper state identifier cleanup is critical for maintaining NFS server stability and preventing resource leakage that could impact overall system performance. The fix ensures complete cleanup of all associated resources while maintaining proper reference counting semantics that prevent premature deallocation or double-free conditions. This comprehensive approach to resource management addresses both immediate security concerns and long-term system reliability requirements in enterprise NFS deployments where persistent state management is critical for data integrity and service availability.