CyberSecBulletin
CVE-2026-53399NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-53399 is a critical-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions d788ef40a7517d22c97ab01700e4ae4c611b6f2f, 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9, 7bbb7ce74051c8be4b69ff44ce3db370600dae61 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.66% chance of exploitation within 30 days, higher than 52% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to d788ef40a7517d22c97ab01700e4ae4c611b6f2f or 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9 or 7bbb7ce74051c8be4b69ff44ce3db370600dae61 or 48a586e382e4db1dbf958d44b63e081df5f8ed04, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxc5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, d788ef40a7517d22c97ab01700e4ae4c611b6f2f; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 7bbb7ce74051c8be4b69ff44ce3db370600dae61; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 48a586e382e4db1dbf958d44b63e081df5f8ed04; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, d369e5edfaaf83a448016e2f1da392b2174be801; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 83c2b7797742339bb768f83935f7ca33950db138; c5c707f96fc9a6e5a57ca5baac892673270abe3d up to, but not including, 30d55c8aabb261bc3f427d6b9aae7ef6206063f9; and 1 more rangesd788ef40a7517d22c97ab01700e4ae4c611b6f2f, 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9, 7bbb7ce74051c8be4b69ff44ce3db370600dae61, 48a586e382e4db1dbf958d44b63e081df5f8ed04, d369e5edfaaf83a448016e2f1da392b2174be801, 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd
LinuxLinux Kernel4.0 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.35.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.