CVE-2026-53393 - Vulnerability Details

- nfsd: reset write verifier on deferred writeback errors

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reset write verifier on deferred writeback errors

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to
detect deferred writeback errors, but neither rotates the server's write
verifier (nn->writeverf) when this check fails. Every other
durable-storage-failure path in these functions calls
commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the
current verifier will COMMIT, receive the unchanged verifier back, and
conclude their data is durable — silently dropping data that failed
writeback. This violates the UNSTABLE+COMMIT durability contract
(RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err()
error sites, matching the pattern used by adjacent error paths in the
same functions. The helper already filters -EAGAIN and -ESTALE
internally, so the calls are unconditionally safe.

Published: 2026-07-19

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s NFS daemon, a bug causes the write verifier to remain unchanged when a deferred writeback error is detected. This omission lets NFS clients whose writes are later discarded believe the data was committed successfully, violating the NFS durability contract and leading to unintentional data loss. The flaw is classed as CWE-390, representing a failure to detect an error condition that results in security failure.

Affected Systems

All Linux kernel releases containing the NFS daemon before the fix are affected, regardless of distribution. The vulnerability resides in the core kernel code, so every system that ships such a kernel and runs an NFS server is at risk until the kernel is updated.

Risk and Exploitability

The CVSS score of 7.0 indicates moderate‑to‑high severity; the EPSS score of less than 1% shows current exploitation likelihood is low. This flaw can be triggered over an NFS connection when a client performs durable writes that encounter deferred writeback errors. The attacker does not need elevated privileges on the server but can cause data loss by simply using the NFS service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f14816f2f928c560d28ba344af689f56efcd6f55`	affected	< b8e5894e56cff70fa245628fe16f0ad6367f8090
`3145fe0ebb16e1715ad541a301bc6675c8375fcd`	affected	< bc2baca02ec56da7707a74ed5d340b0a1dff1841
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 43b65d2997963e80e8d8d86520bcb1e0751227de
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 666e837b247fcadf2d8d508b9b0e49d720393eb4
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 1dd664b39774a9c89b72de8e59bf9ef4b3aaff2e
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 4367afc119c51e17a616f6908772b7e2c2c4013f
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< b027cca33c97354149fcc0ddeede4525c41093cd
`555dbf1a9aac6d3150c8b52fa35f768a692f4eeb`	affected	< 2090b05803faab8a9fa62fbff871007862cac1b7
`5.10.124`	affected	< 5.10.261
`5.15.49`	affected	< 5.15.212

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,1dd664b39774a9c89b72de8e59bf9ef4b3aaff2e)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,4367afc11974a9c89b72de8e59bf9ef4b3aaff2e)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,b027cca33c97354149fcc0ddeede4525c41093cd)`	affected	code_commit	—
`[555dbf1a9aac6d3150c8b52fa35f768a692f4eeb,2090b05803faab8a9fa62fbff871007862cac1b7)`	affected	code_commit	—
`f14816f2f928c560d28ba344af689f56efcd6f55`	affected	code_commit	—
`3145fe0ebb16e1715ad541a301bc6675c8375fcd`	affected	code_commit	—
`[5.10.124,5.11)`	affected	semver	—
`[5.15.49,5.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the commit_reset_write_verifier() calls in nfsd_vfs_write() and nfsd_commit()
Restart the NFS service to fully load the patched kernel module
If a kernel upgrade cannot be performed immediately, disable the NFS server or restrict its availability until the patch is applied

Generated by OpenCVE AI on July 30, 2026 at 22:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00134.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1dd664b39774a9c89b72de8e59bf9ef4b3aaff2e
https://git.kernel.org/stable/c/2090b05803faab8a9fa62fbff871007862cac1b7
https://git.kernel.org/stable/c/4367afc119c51e17a616f6908772b7e2c2c4013f
https://git.kernel.org/stable/c/43b65d2997963e80e8d8d86520bcb1e0751227de
https://git.kernel.org/stable/c/666e837b247fcadf2d8d508b9b0e49d720393eb4
https://git.kernel.org/stable/c/b027cca33c97354149fcc0ddeede4525c41093cd
https://git.kernel.org/stable/c/b8e5894e56cff70fa245628fe16f0ad6367f8090
https://git.kernel.org/stable/c/bc2baca02ec56da7707a74ed5d340b0a1dff1841
https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-53393-37ff@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53393
https://www.cve.org/CVERecord?id=CVE-2026-53393

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/43b65d2997963e80e8d8d86520bcb1e0751227de https://git.kernel.org/stable/c/666e837b247fcadf2d8d508b9b0e49d720393eb4 https://git.kernel.org/stable/c/b8e5894e56cff70fa245628fe16f0ad6367f8090 https://git.kernel.org/stable/c/bc2baca02ec56da7707a74ed5d340b0a1dff1841

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-390
References		https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-53393-37ff@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53393 https://www.cve.org/CVERecord?id=CVE-2026-53393
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error. The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable — silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32). Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.
Title		nfsd: reset write verifier on deferred writeback errors
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1dd664b39774a9c89b72de8e59bf9ef4b3aaff2e https://git.kernel.org/stable/c/2090b05803faab8a9fa62fbff871007862cac1b7 https://git.kernel.org/stable/c/4367afc119c51e17a616f6908772b7e2c2c4013f https://git.kernel.org/stable/c/b027cca33c97354149fcc0ddeede4525c41093cd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:01:56.684Z

Updated: 2026-07-24T14:33:59.642Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53393

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53393 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-390
Detection of Error Condition Without Action

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object