CVE-2026-53396 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
nfsd4_create_file() has two bugs in its ACL handling:
The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE.
When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX).
Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical security flaw in the Linux kernel's NFSv4 server implementation, specifically within the nfsd4_create_file function that handles file creation operations. This issue stems from improper error handling and resource management during POSIX Access Control List (ACL) processing, creating potential security implications for network file systems. The vulnerability demonstrates poor defensive programming practices that can lead to both information disclosure and resource exhaustion attacks.
The technical flaw manifests in two distinct but related failure modes within the NFSv4 server's ACL handling mechanism. The first bug occurs when nfsd4_acl_to_attr() function returns an error code indicating failed ACL conversion, such as -EINVAL for unsupported ACE types, but this return value is silently discarded. This allows malformed or unsupported ACL attributes to be ignored during file creation operations, resulting in files being created without proper access controls while the client receives a successful NFS4_OK response. According to RFC 7530 and RFC 8881 standards that govern NFSv4 protocol behavior, servers must reject unsupported attributes during CREATE operations to maintain data integrity and security boundaries. The second bug involves improper error path handling where if start_creating() fails after ACL attributes have been populated in the attrs structure, execution jumps to out_write instead of the proper out cleanup label, causing posix_acl memory allocations to be leaked. This resource leak occurs because nfsd_attrs_free() is bypassed, creating a potential denial-of-service vector.
The operational impact of this vulnerability extends beyond simple error handling failures into serious security implications. Attackers can exploit this weakness by repeatedly submitting OPEN(CREATE) operations with valid ACL attributes and invalid filenames that exceed NAME_MAX limits, triggering the resource leak condition multiple times. This creates an avenue for memory exhaustion attacks that could destabilize NFS servers under sustained attack conditions. Additionally, the silent failure of unsupported ACL types means that security policies defined through NFSv4 ACLs may be ignored, potentially allowing unauthorized access to files and directories. The vulnerability affects systems running Linux kernels with NFSv4 server functionality, particularly those handling network file operations where ACL enforcement is critical for security.
Mitigation strategies should focus on immediate kernel updates addressing the specific implementation flaws in nfsd4_create_file. System administrators must ensure their NFS servers are running patched kernel versions that properly handle return values from ACL conversion functions and maintain correct error path execution. The fix implements proper return value checking for nfsd4_acl_to_attr() calls, ensuring that unsupported attributes result in appropriate error responses rather than silent failures. Additionally, the error handling paths have been corrected to ensure proper resource cleanup by changing early error jumps to use the out label instead of out_write, preventing posix_acl memory leaks. The initialization of child to ERR_PTR(-EINVAL) provides a safety mechanism for end_creating() function calls even when start_creating() was never successfully executed, ensuring robust error recovery throughout the file creation process.
This vulnerability aligns with CWE-704 (Incorrect Type Conversion or Cast) and CWE-457 (Use of Uninitialized Variable) categories in the Common Weakness Enumeration catalog, as it involves improper handling of return values and resource management. From an ATT&CK framework perspective, this represents a privilege escalation opportunity through protocol manipulation (T1068) and resource exhaustion techniques (T1499). The vulnerability demonstrates how seemingly minor implementation flaws in system-level components can create significant security risks in network services, emphasizing the importance of rigorous error handling and proper resource management in kernel space code. Organizations should monitor for affected systems and implement immediate patching procedures to address this vulnerability before potential exploitation occurs.
The fix demonstrates proper defensive programming practices by ensuring all return values are checked, error paths properly clean up resources, and protocol compliance is maintained through appropriate error responses rather than silent failures that could compromise security policies. This vulnerability serves as an important reminder of the critical nature of proper error handling in system-level software where protocol violations can have far-reaching security implications for networked file systems.