CVE-2026-53399

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release layout stid on setlease failure

nfs4allocstid() publishes the new stid into cl->cl_stateids via

idralloccyclic() under cl_lock before returning to

nfsd4alloclayoutstateid(). When nfsd4layout_setlease() then

fails, the error path frees the layout stateid directly with

kmemcachefree() without ever calling idr_remove(), leaving the

IDR slot pointing at freed slab memory. Any subsequent IDR walker

(states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4putstid(),

which removes the IDR slot under cllock, dispatches scfree

(nfsd4freelayoutstateid) to release ls->lsfile via

nfsd4closelayout(), and drops the nfs4_file reference in its

tail.

A second issue blocks that switch: nfsd4freelayout_stateid()

unconditionally inspects ls->lsfencework via

delayedworkpending() under ls_lock, but

INITDELAYEDWORK(&ls->lsfencework, ...) currently runs only

after the setlease call. On the setlease-failure path the

destructor would touch an uninitialized delayed_work.

    nfsd4alloclayout_stateid()

      nfs4allocstid()           / idralloccyclic under cl_lock /

      nfsd4layoutsetlease()     / fails /

        nfs4putstid()

          nfsd4freelayout_stateid()

            delayedworkpending(&ls->lsfencework)  / needs INIT /

            nfsd4closelayout()  / nfsdfileput(ls->ls_file) /

          putnfs4file()

Fix by hoisting the lsfenced / lsfencedelay / INITDELAYED_WORK

initialization above the nfsd4layoutsetlease() call, and replace

the manual nfsdfileput + putnfs4file + kmemcachefree cleanup

with a single nfs4putstid(stp).