EUVD-2026-59463
GHSA-2mq4-hj52-9fc6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
pNFS layout use and prior admin revocation raise AC to H; NFS client authorization implies PR:L; only availability is impacted.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or releasing the stid. The stid remains in the IDR and on the per-client list until the client is destroyed.
Remove the layout stid from the per-client list and call nfs4_put_stid() to drop the creation reference. When the refcount reaches zero, nfsd4_free_layout_stateid() handles the remaining cleanup: cancelling the fence worker, removing from the per-file list, and freeing the slab object.
AnalysisAI
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires four concurrent conditions: (1) the Linux kernel NFS server (NFSD) must be running with pNFS (parallel NFS) layout support enabled - this is a specific server configuration, not a default on general-purpose Linux hosts; (2) a layout stateid must have been issued to an NFS client and subsequently admin-revoked on the server side - the administrator must take the revocation action first; (3) the client must then send a FREE_STATEID NFSv4 operation targeting that specific revoked layout stateid; and (4) the kernel version must be unpatched, within the affected commit range starting from 1e33e1414bec. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as High severity with network-accessible, unauthenticated exploitation - but that framing overstates real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authorized NFS client connected to a Linux NFSD server using pNFS layout stateids observes that the server administrator has revoked one of its layout stateids. The client dutifully sends a FREE_STATEID operation as required by the NFSv4.2 protocol. … |
| Remediation | The primary fix is to upgrade the Linux kernel to a patched stable release: 6.12.97 or later for the 6.12 LTS branch, 6.18.40 or later for the 6.18 branch, 7.1.5 or later for the 7.1 series, or any build at or after the 7.2-rc1 mainline tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Linux NFS servers with pNFS enabled and assess their service criticality to your operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today