Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-53399

A use-after-free vulnerability in the Linux kernel's NFS daemon (CVE-2026-53399) allows an attacker to execute arbitrary code, cause a denial of service, or escalate privileges when setting a lease fails. The flaw occurs because the kernel frees a layout state ID without removing it from an internal IDR table, leaving a dangling pointer that subsequent code can dereference. The issue is fixed by initializing delayed work earlier and using the proper cleanup function (nfs4_put_stid) instead of manual freeing.

publishedJul 19, 2026
last modifiedJul 29, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
41th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 19, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Linux kernel NFS daemon (nfsd) code paths that allocate layout state IDs and call nfsd4_layout_setlease().

02

Real-world impact

An attacker could exploit this to gain elevated privileges, crash the system, or run arbitrary code on affected Linux systems.

03

Why this severity

CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 01Apply the Linux kernel patch that moves the initialization of ls_fenced, ls_fence_delay, and INIT_DELAYED_WORK before the nfsd4_layout_setlease() call and replaces the manual cleanup sequence with a single nfs4_put_stid() call.

NVD description

05

Timeline

  1. Jul 19, 2026 · 11d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 20, 2026 · 10d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Jul 29, 2026 · 16h ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →