CVE-2026-53396
Received Received - Intake

Memory Leak and ACL Handling Flaw in Linux Kernel NFS Server

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53396
EUVD
EUVD-2026-45518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves two bugs in the NFSv4 server's file creation process. First, errors from ACL conversion are ignored, allowing files to be created without proper ACLs even when the client requested them. Second, memory leaks occur when ACL allocations are not freed if file creation fails after ACLs are set.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS server (nfsd) and involves ACL handling during file creation. Detection requires checking kernel logs for NFS-related errors or examining kernel memory for ACL leaks. Commands like dmesg | grep nfsd or journalctl -u nfs-server may show errors. Monitor for repeated CREATE operations with ACL attributes and invalid filenames.

Impact Analysis

An attacker could exploit this to bypass ACL restrictions on files, potentially gaining unauthorized access. Repeated exploitation could also cause memory exhaustion due to leaked ACL allocations, leading to system instability or crashes.

Compliance Impact

This vulnerability could violate compliance requirements that mandate proper ACL enforcement for data access controls, such as GDPR's data protection measures or HIPAA's access control rules. Unauthorized access due to missing ACLs may lead to non-compliance penalties.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the posix_acl leak and ACL handling issues in nfsd4_create_file. Monitor NFS server logs for CREATE operations with ACL attributes and invalid filenames to detect potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart