CVE-2026-53398 - Vulnerability Details

- NFSD: Fix SECINFO_NO_NAME decode error cleanup

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix SECINFO_NO_NAME decode error cleanup

nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
decoding sin_style. If the XDR stream is truncated, the decoder returns
nfserr_bad_xdr before sin_exp is initialized.

Since commit 3fdc54646234 ("NFSD: Reduce amount of struct
nfsd4_compoundargs that needs clearing"), the inline iops array is not
cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore
leave sin_exp holding stale union contents from a previous operation.

The error response path still invokes nfsd4_secinfo_no_name_release(),
which calls exp_put() on a non-NULL sin_exp.

Initialize sin_exp before the first failable decode step, matching
nfsd4_decode_secinfo().

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the NFS server’s SECINFO_NO_NAME decoder causes an uninitialized "sin_exp" field when a truncated XDR stream is received. The error handling path still releases this stale pointer, leading to memory corruption that can trigger a kernel panic or, if an attacker can exploit the corrupted state, arbitrary code execution with kernel privileges. The weakness is an example of CWE‑824, improper initialization of a structure before use.

Affected Systems

The issue affects any Linux kernel that includes the nfsd4 module and does not contain the commit 3fdc54646234, which initializes the "sin_exp" field prior to decoding. This applies to all kernels that process SECINFO_NO_NAME requests in the NFSv4 protocol. Administrators should verify whether their running kernel implements this commit or is based on a version older than it.

Risk and Exploitability

With a CVSS score of 9.8 the vulnerability is critical, and its EPSS score of <1% indicates a low current exploitation probability. The flaw is reachable over the network via crafted NFS requests, likely requiring the ability to send malformed SECINFO_NO_NAME data. The vulnerability is not yet listed in the CISA KEV catalog, but its severity warrants proactive remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e76b25d7cc82c148d391c0c43b884e6427cb302`	affected	< 8836405abdc53ca3dd5fc68b2cf6f8f012fad011
`07b68ff5c71cf4ed5443016d8eb116863c0a4d88`	affected	< 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< 5ec37edcb534f3fc92304be236d37f08e6545585
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< 1e04be34cafae119e82bcaccd6d28a20f72a3647
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< 161d1aaeb04d620d3692639700512bb5038c1e10
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< c8a24effd96d4779e2ad779654682304491c55a5
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< 46eb17d45be69d28c7a23ea03283b207426a8232
`3fdc546462348b8a497c72bc894e0cde9f10fc40`	affected	< 9e18e83b8846a5c3fe13fc8a464b4865d33996c6
`5.10.220`	affected	< 5.10.260
`5.15.154`	affected	< 5.15.211

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5e76b25d7cc82c148d391c0c43b884e6427cb302,8836405abdc53ca3dd5fc68b2cf6f8f012fad011)`	affected	code_commit	—
`[07b68ff5c71cf4ed5443016d8eb116863c0a4d88,49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,5ec37edcb534f3fc92304be236d37f08e6545585)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,1e04be34cafae119e82bcaccd6d28a20f72a3647)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,161d1aaeb04d620d3692639700512bb5038c1e10)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,c8a24effd96d4779e2ad779654682304491c55a5)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,46eb17d45be69d28c7a23ea03283b207426a8232)`	affected	code_commit	—
`[3fdc546462348b8a497c72bc894e0cde9f10fc40,9e18e83b8846a5c3fe13fc8a464b4865d33996c6)`	affected	code_commit	—
`[5.10.220,5.10.260)`	affected	semver	—
`[5.15.154,5.15.211)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.1`	affected	generic	—
`[0,6.1)`	unaffected	generic	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the patch that adds proper initialization of sin_exp before decoding, such as the commit 3fdc54646234 from the Linux kernel tree, or backport it to your current kernel version.
Reboot the system to load the updated kernel or reload the nfsd module after patching to ensure the corrected code is executed.
If a patch cannot be applied immediately, limit NFS traffic to trusted internal networks or temporarily disable the NFS service until the fix is installed.

Generated by OpenCVE AI on July 30, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10
https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647
https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232
https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439
https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585
https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011
https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6
https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5
https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53398
https://www.cve.org/CVERecord?id=CVE-2026-53398

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53398 https://www.cve.org/CVERecord?id=CVE-2026-53398
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().
Title		NFSD: Fix SECINFO_NO_NAME decode error cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10 https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647 https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232 https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585 https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011 https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6 https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:01:59.507Z

Updated: 2026-08-05T12:35:37.662Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53398

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53398 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object