CVE-2026-53395: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals…

PriorityP341high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.34%

27.0th percentile

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().

Affected

5 ranges

Vendor	Product	Version range	Fixed in
linux	linux	—	—
linux	linux	>= d2ca50606f5f0235d7780c1cd73b6614a5d07620 < 8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e	8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e
linux	linux	>= d2ca50606f5f0235d7780c1cd73b6614a5d07620 < a60f25a800846ab8e5a13f8a9d05111f2aee55a7	a60f25a800846ab8e5a13f8a9d05111f2aee55a7
linux	linux_kernel	—	—
linux	linux_kernel	>= 7.0 < 7.1.3	7.1.3

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.