The flaw is in the Linux kernel’s NFSv4.0 server in the routine that allocates open state owners. When an unconfirmed owner is found, the code clears the existing pointer but then continues to allocate a new state owner unconditionally. If a prior allocation still exists from a previous iteration, the pointer to that allocation is overwritten and the previously allocated slab object and its associated owner name buffer leak into uninitialized memory. This is a classic runtime memory‑leak scenario (CWE‑772) that allows an attacker to read kernel memory that should remain private. The leak may not directly grant arbitrary code execution, but it can reveal sensitive data or disrupt the NFS service by exhausting memory or corrupting critical bookkeeping structures.

All Linux kernel implementations that have not merged the upstream fix for CVE‑2026‑53394 are affected, regardless of distribution. The vulnerability resides entirely in the NFSv4.0 server code, so systems that run a vulnerable kernel and expose the NFSv4.0 service are at risk. Specific kernel versions are not enumerated in the CVE data; users should verify whether their installed kernel already includes the patch. Any Linux machine serving NFSv4.0 clients could be impacted, including servers, routers, and embedded devices.

The CVSS score of 7.5 categorizes this as high severity. The EPSS score of less than 1% and the absence from CISA's KEV catalog suggest that real‑world exploitation is currently unlikely, yet the narrow race condition can be engineered by a malicious NFS client generating repeated OPEN requests with the same owner string. The attack requires no privilege elevation on the client side, making the threat surface larger. If successful, the attacker could continuously leak slices of kernel memory or cause a denial of service by causing repeated allocations to fail or by exhausting memory resources.