CVE-2026-74316 NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
A missing case in the Linux kernel NFS server causes a memory leak when handling revoked layout state IDs, potentially leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74316?
CVE-2026-74316 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default branch releases cl_lock and returns without unhashing or releasing the stid. The stid remains in the IDR and on the per-client list until the client is destroyed.
Remove the layout stid from the per-client list and call nfs4_put_stid() to drop the creation reference. When the refcount reaches zero, nfsd4_free_layout_stateid() handles the remaining cleanup: cancelling the fence worker, removing from the per-file list, and freeing the slab object.
Which versions are affected by CVE-2026-74316?
How do I fix CVE-2026-74316?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74316 being exploited?
There is no known exploitation of CVE-2026-74316 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74316, DEBIAN-CVE-2026-74316, GHSA-2mq4-hj52-9fc6, UBUNTU-CVE-2026-74316.