---
id: CVE-2026-74316
title: 'NFSD: Handle layout stid in nfsd4_drop_revoked_stid()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Handle layout stid in nfsd4_drop_revoked_stid()

  nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a
  client sends FREE_STATEID for an admin-revoked la…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 <
    7ed62f7040ee182cf7dea5798f9e114235b31dae
  - >-
    Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 <
    da6f86ff4f2dd490bea52419a49e19680efd5847
  - >-
    Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 <
    8024028ef91616cf91cc669f2446a0406bc0ba19
  - >-
    Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 <
    86b9898920a6d02b4149f4fef9efd77b8aa3b9ca
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:53:13.510703Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:32.624Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74316'
references:
  - url: 'https://git.kernel.org/stable/c/7ed62f7040ee182cf7dea5798f9e114235b31dae'
  - url: 'https://git.kernel.org/stable/c/da6f86ff4f2dd490bea52419a49e19680efd5847'
  - url: 'https://git.kernel.org/stable/c/8024028ef91616cf91cc669f2446a0406bc0ba19'
  - url: 'https://git.kernel.org/stable/c/86b9898920a6d02b4149f4fef9efd77b8aa3b9ca'
tags:
  - cve.org
epss: 0.0063
epssPercentile: 0.49108
ingestedAt: '2026-10-16T19:46:24.379Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Handle layout stid in nfsd4_drop_revoked_stid()

nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a
client sends FREE_STATEID for an admin-revoked layout stid, the
default branch releases cl_lock and returns without unhashing or
releasing the stid.  The stid remains in the IDR and on the
per-client list until the client is destroyed.

Remove the layout stid from the per-client list and call
nfs4_put_stid() to drop the creation reference.  When the
refcount reaches zero, nfsd4_free_layout_stateid() handles the
remaining cleanup: cancelling the fence worker, removing from
the per-file list, and freeing the slab object.

## Affected

- `Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 < 7ed62f7040ee182cf7dea5798f9e114235b31dae`
- `Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 < da6f86ff4f2dd490bea52419a49e19680efd5847`
- `Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 < 8024028ef91616cf91cc669f2446a0406bc0ba19`
- `Linux >= 1e33e1414bec54a4feafa9e67e2617031be0afe2 < 86b9898920a6d02b4149f4fef9efd77b8aa3b9ca`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.