CVE-2026-74316

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Handle layout stid in nfsd4_drop_revoked_stid()

nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a

client sends FREE_STATEID for an admin-revoked layout stid, the

default branch releases cl_lock and returns without unhashing or

releasing the stid. The stid remains in the IDR and on the

per-client list until the client is destroyed.

Remove the layout stid from the per-client list and call

nfs4_put_stid() to drop the creation reference. When the

refcount reaches zero, nfsd4_free_layout_stateid() handles the

remaining cleanup: cancelling the fence worker, removing from

the per-file list, and freeing the slab object.