CVE-2026-53395 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix dead ACL conflict guard in nfsd4_create
nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code:
if (create->cr_acl) {
if (create->cr_dpacl || create->cr_pacl) /* always false */
When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr
bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion.
Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the Linux kernel's nfsd implementation, specifically in the nfsd4_create function where a critical flaw exists in access control list handling that creates both a logical error and resource exhaustion condition. This issue manifests when processing CREATE operations with specific attribute combinations that trigger improper memory management patterns.
The technical flaw occurs through a flawed pointer management sequence within nfsd4_create() where the function correctly transfers ownership of ACL pointers from the create structure's cr_dpacl and cr_pacl fields into local nfsd_attrs structure using designated initializers. However, immediately after this transfer, the original source pointers are set to NULL, creating a situation where subsequent conflict guard tests operate against nilled references rather than the actual data. This design creates permanently dead code that cannot function as intended since the condition check for create->cr_dpacl or create->cr_pacl will always evaluate to false once the pointers have been cleared.
The operational impact of this vulnerability extends beyond simple code inefficiency into a serious resource exhaustion scenario that can be exploited by malicious actors. When clients submit CREATE requests containing both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL flags within the same fattr bitmap, the nfsd4_acl_to_attr() function executes an incorrect memory management pattern that fails to release the original posix_acl slab objects before overwriting them with new values. This results in a memory leak of two posix_acl slab objects per request, which accumulates over repeated requests leading to unbounded slab exhaustion that can eventually cause system instability or denial of service conditions.
This vulnerability type maps directly to CWE-457: Use of Uninitialized Variable and CWE-1236: Improper Check for Duplicated Code patterns, where the improper initialization leads to resource leaks and the duplicated code pattern creates dead logic. From an ATT&CK perspective, this represents a resource exhaustion attack vector that could be leveraged in combination with other techniques to disrupt NFS services. The fix implemented addresses this by changing the conflict guard logic to test the stolen values stored in attrs.na_dpacl/na_pacl rather than the nilled source pointers, which aligns with the proper memory management pattern already established in the nfsd4_setattr() function. This correction ensures that ACL resources are properly managed and released during attribute processing, preventing the accumulation of leaked slab objects while maintaining the intended security controls for access control list management within the NFS daemon implementation.