The vulnerability resides in the Linux NFS daemon’s handling of SETACL operations. When the first ACL decode succeeds but the second fails, the decoder returns false and the first allocated posix_acl remains in memory without being freed. This creates a memory leak (CWE-401) and a resource leak (CWE-772), allowing the leaking objects to persist for the lifetime of the server. Accumulation of such leaks can eventually exhaust system memory and cripple the NFS service, effectively resulting in a denial‑of‑service situation for clients that can trigger the failure path.

All Linux kernel releases that include an NFS server but do not yet contain the CVE‑2026‑53397 patch are affected. The flaw is triggered during processing of SETACL requests, so any host running a vulnerable kernel and exposing an NFS export is at risk, regardless of the NFS protocol version. No specific kernel versions were listed in the advisory, so administrators should assume all unpatched kernels prior to the fix are vulnerable.

The CVSS score of 7.5 flags the flaw as high severity. The EPSS score of less than 1% indicates that exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. The flaw is reachable by remote actors who can send crafted SETACL requests to the NFS service; no additional privileges beyond access to the service are required. Once a successful decode failure occurs, the kernel will retain the leaked ACL object, gradually consuming memory until the service becomes unable to serve requests, leading to success of a denial‑of‑service attack.