In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work,
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53399 is a critical memory safety vulnerability in the Linux kernel's NFS server (nfsd) implementation affecting layout state management. The flaw occurs when the nfsd4_layout_setlease() function fails after a layout state ID (stid) has been allocated and published into the client's state ID registry. The vulnerability leaves an IDR (ID Radix tree) slot pointing to freed slab memory, creating a use-after-free condition. This impacts Linux systems running NFS servers that handle NFS4 layout operations, particularly those serving storage or cluster environments. The CVSS 9.8 critical rating reflects the potential for kernel memory corruption, denial of service, and potential privilege escalation when IDR walkers subsequently access the dangling pointer.
While Casky currently shows zero matching skills for this specific CVE, practitioners using Claude AI-powered security analysis would focus detection efforts on kernel memory management anomalies and resource cleanup failures. Relevant MITRE ATT&CK patterns include T1203 (Exploitation for Privilege Escalation) and T1499 (Endpoint Denial of Service) if the memory corruption leads to kernel panics. Detection would center on monitoring nfsd error logs for setlease failures, kernel panic dumps referencing IDR memory regions, and anomalous NFS4 layout operation sequences. System administrators should prioritize patching Linux kernel versions running nfsd with active NFS4 clients, and monitor for unexpected kernel crashes or memory corruption signatures in affected environments.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53399. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation