CVE-2026-53396 nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
A memory leak in the Linux kernel NFS server allows remote attackers to cause denial of service by triggering repeated file creation failures with invalid ACLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53396?
CVE-2026-53396 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
nfsd4_create_file() has two bugs in its ACL handling:
The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE.
When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX).
Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.
Weakness: CWE-401
Which versions are affected by CVE-2026-53396?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53396?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53396 being exploited?
There is no known exploitation of CVE-2026-53396 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-53396, GHSA-x7f6-m4r7-q3h7, UBUNTU-CVE-2026-53396.