{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53396","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.402Z","datePublished":"2026-07-19T12:01:58.375Z","dateUpdated":"2026-08-17T04:50:48.148Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:50:48.148Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak and ignored error in nfsd4_create_file\n\nnfsd4_create_file() has two bugs in its ACL handling:\n\nThe return value of nfsd4_acl_to_attr() is silently discarded.  When\nthe NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for\nunsupported ACE types), the file is created without any ACL and the\nclient receives NFS4_OK.  This violates RFC 7530/8881 which require\nthe server to reject unsupported attributes on CREATE.\n\nWhen start_creating() fails after ACL attributes have been populated\nin attrs (either via nfsd4_acl_to_attr or via ownership transfer from\nopen->op_dpacl/op_pacl), the function jumps to out_write which skips\nnfsd_attrs_free().  The posix_acl allocations are leaked.  A client\ncan trigger this repeatedly with OPEN(CREATE), ACL attributes, and an\ninvalid filename (e.g., longer than NAME_MAX).\n\nFix both by capturing the nfsd4_acl_to_attr() return value and by\nchanging the early error paths to jump to out instead of out_write.\nInitialize child to ERR_PTR(-EINVAL) so that end_creating() is safe\nto call even if start_creating() was never reached."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached via NFSv4 OPEN(CREATE) handled by nfsd over the network (RPC on TCP/2049), from nfsd4_proc_compound() through nfsd4_open() and do_open_lookup() into nfsd4_create_file().\nAC:L - An authenticated NFS client can reliably trigger the leak by sending OPEN(CREATE) with ACL attributes and a filename that causes start_creating() to fail (e.g., longer than the backing filesystem NAME_MAX); no race or attacker-uncontrollable conditions are required.\nPR:L - Exploitation requires an authenticated NFS client with write/create permission on the target export directory (enforced by fh_verify()/nfsd_permission), which maps to basic authorized-user access rather than unauthenticated or server-admin privileges.\nUI:N - No victim interaction is needed beyond the attacker sending crafted NFSv4 compound requests to the server.\nS:U - Impact is confined to kernel memory management and exported file metadata within the NFS server's security authority; it does not cross VM, container, or IOMMU boundaries.\nC:N - The bug is a refcount leak of posix_acl kernel objects with no out-of-bounds read, use-after-free, or other mechanism that exposes kernel memory to the attacker.\nI:L - The ignored nfsd4_acl_to_attr() error allows files to be created without the requested ACL while returning NFS4_OK, causing limited but incorrect modification of exported file security attributes on shared storage.\nA:H - Repeated triggering leaks unbounded posix_acl slab objects per request, enabling sustained kernel memory exhaustion that can deny NFS service and degrade overall system availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4proc.c"],"versions":[{"version":"7ab96df840e60eb933abfe65fc5fe44e72f16dc0","lessThan":"18cf006a08babec0bbac2a3784f8f28e56e47490","status":"affected","versionType":"git"},{"version":"7ab96df840e60eb933abfe65fc5fe44e72f16dc0","lessThan":"24c975bbdd564d7d0ad90294bfa69729830345de","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4proc.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/18cf006a08babec0bbac2a3784f8f28e56e47490"},{"url":"https://git.kernel.org/stable/c/24c975bbdd564d7d0ad90294bfa69729830345de"}],"title":"nfsd: fix posix_acl leak and ignored error in nfsd4_create_file","x_generator":{"engine":"bippy-1.2.0"}}}}