CVE-2026-53397 - Vulnerability Details

- nfsd: fix posix_acl leak on SETACL decode failure

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix posix_acl leak on SETACL decode failure

nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each
call nfs_stream_decode_acl() twice, first for NFS_ACL and then for
NFS_DFACL. Each successful call transfers ownership of a freshly
allocated posix_acl into argp->acl_access or argp->acl_default. If
the first call succeeds but the second fails, the decoder returns
false and argp->acl_access is left dangling.

ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and
ACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.
Both only call fh_put() and have no knowledge of the ACL fields on
argp. The posix_acl_release() pairs sat at the out: labels inside
nfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()
skips pc_func when pc_decode returns false, so that cleanup is
unreachable on decode failure:

svc_process_common()
pc_decode() /* decode_setaclargs: false */
/* pc_func skipped */
pc_release() /* fh_put only -- ACLs leaked */

The orphaned posix_acl is leaked for the lifetime of the server.

Fix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),
which release both argp->acl_access and argp->acl_default in addition
to fh_put(), and wiring them as pc_release for their respective SETACL
procedures. pc_release runs on every path svc_process() takes after
decode, including decode failure, so the posix_acl_release() pairs are
removed from the proc functions' out: labels to keep ownership in one
place. This matches the existing release_getacl() pattern used by
the sibling GETACL procedures.

Published: 2026-07-19

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the NFS daemon's handling of SETACL operations. When the first ACL decode succeeds but the second fails, the decoder returns false and the first allocated ACL is left in memory without being freed. Consequently, the NFS server leaks a posix_acl for its entire lifetime. Repeated failures can accumulate memory and eventually exhaust system resources, effectively enabling a denial‑of‑service attack.

Affected Systems

All Linux kernel releases that ship with the NFS server and have not yet incorporated the fix for CVE‑2026‑53397 are affected. The problem exists in any kernel that processes NFS SETACL requests during operation, regardless of NFS protocol version because the issue is in the server‑side implementation. No specific version numbers are included in the advisory.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests that known exploits are rare at present. The vulnerability is not listed in the CISA KEV catalog. It is inferred that a remote attacker could exploit the flaw by sending crafted NFS SETACL requests from a client that communicates with the vulnerable NFS daemon; the server would then leak ACL objects, leading to gradual memory consumption and potential service disruption. No special privileges beyond access to the NFS service are required.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< b2eb1ffd511d1b3c3e21122f97cbbccea411e277
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< b94c4be77682aab06d65ca7296149e3bcfb37353
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< 887f92ceccf3eacd5f2402db21254d66372fae00
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< 1e96239fddcefacf6afe6c498357be68eacbcabc
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< bd69a825485168ef74e815ecb286754b570fdcc7
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< 136b416593f1349cf6f72c8e3d18f0f204ee8545
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< a5b42c1e4ff2befaa6b96f7cbf32174751eba083
`a257cdd0e2179630d3201c32ba14d7fcb3c3a055`	affected	< 0853ac544c590880d797b04daa33fcb72b6be0e1

Linux

affected

Version	Status	Constraints
`2.6.13`	affected	—
`0`	unaffected	< 2.6.13
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,b2eb1ffd511d1b3c3e21122f97cbbccea411e277)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,b94c4be77682aab06d65ca7296149e3bcfb37353)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,887f92ceccf3eacd5f2402db21254d66372fae00)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,1e96239fddcefacf6afe6c498357be68eacbcabc)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,bd69a825485168ef74e815ecb286754b570fdcc7)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,136b416593f1349cf6f72c8e3d18f0f204ee8545)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,a5b42c1e4ff2befaa6b96f7cbf32174751eba083)`	affected	code_commit	—
`[a257cdd0e2179630d3201c32ba14d7fcb3c3a055,0853ac544c590880d797b04daa33fcb72b6be0e1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.13`	affected	semver	—
`[0,2.6.13)`	unaffected	semver	—
`[5.10.260,5.10.*]`	unaffected	generic	—
`[5.15.211,5.15.*]`	unaffected	generic	—
`[6.1.177,6.1.*]`	unaffected	generic	—
`[6.6.144,6.6.*]`	unaffected	generic	—
`[6.12.95,6.12.*]`	unaffected	generic	—
`[6.18.38,6.18.*]`	unaffected	generic	—
`[7.1.3,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the CVE‑2026‑53397 patch, which adds proper cleanup for ACL fields in SETACL operations.
After upgrading, restart the NFS service or reboot the host to load the new kernel code.
If an immediate kernel upgrade is not feasible, use firewall rules or NFS export options to block or refuse SETACL operations from untrusted clients, thereby preventing repeated decode failures.

Generated by OpenCVE AI on August 3, 2026 at 02:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00529.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1
https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545
https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc
https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00
https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083
https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277
https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353
https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7
https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53397-396f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53397
https://www.cve.org/CVERecord?id=CVE-2026-53397

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53397-396f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53397 https://www.cve.org/CVERecord?id=CVE-2026-53397
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFACL. Each successful call transfers ownership of a freshly allocated posix_acl into argp->acl_access or argp->acl_default. If the first call succeeds but the second fails, the decoder returns false and argp->acl_access is left dangling. ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and ACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle. Both only call fh_put() and have no knowledge of the ACL fields on argp. The posix_acl_release() pairs sat at the out: labels inside nfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process() skips pc_func when pc_decode returns false, so that cleanup is unreachable on decode failure: svc_process_common() pc_decode() /* decode_setaclargs: false / / pc_func skipped / pc_release() / fh_put only -- ACLs leaked */ The orphaned posix_acl is leaked for the lifetime of the server. Fix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(), which release both argp->acl_access and argp->acl_default in addition to fh_put(), and wiring them as pc_release for their respective SETACL procedures. pc_release runs on every path svc_process() takes after decode, including decode failure, so the posix_acl_release() pairs are removed from the proc functions' out: labels to keep ownership in one place. This matches the existing release_getacl() pattern used by the sibling GETACL procedures.
Title		nfsd: fix posix_acl leak on SETACL decode failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1 https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545 https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00 https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083 https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277 https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353 https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:01:58.938Z

Updated: 2026-08-05T12:35:36.597Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53397

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53397 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T02:45:03Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object