Executive brief
The Linux kernel's NFSD (Network File System Daemon) component has a resource leak in its handling of revoked layout state identifiers. When a client sends a FREE_STATEID request for an admin-revoked layout, the server fails to properly clean up the stateID object, leaving it orphaned in memory until the client disconnects. This could allow a malicious or misbehaving NFS client to exhaust server memory and cause denial of service.
Technical details
The vulnerability is a resource leak in the nfsd4_drop_revoked_stid() function in fs/nfsd/nfs4state.c. The function handles cleanup of revoked stateid objects but lacks a case for SC_TYPE_LAYOUT stateids. When a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or releasing the stid, leaving it in the IDR tree and per-client list. The fix adds a SC_TYPE_LAYOUT case that removes the layout stid from the per-client list and calls nfs4_put_stid() to drop the creation reference, allowing nfsd4_free_layout_stateid() to handle final cleanup. Exploitation requires network access to an NFS server and the ability to trigger admin revocation of layout state, but once triggered can be repeated to leak memory and degrade service.
Affected products
- Linux Linux kernel versions with NFSD layout state admin-revocation support (Linux 5.9 and later)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched