CVE-2026-53398 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix SECINFO_NO_NAME decode error cleanup
nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized.
Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation.
The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp.
Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the Network File System Daemon (NFSD) component of the Linux kernel, specifically addressing a critical issue in the SECINFO_NO_NAME operation handling. The flaw manifests when processing XDR streams containing truncated data during NFSv4 operations, creating a scenario where memory corruption and potential privilege escalation could occur through improper error path handling.
The technical implementation problem stems from the order of operations within the nfsd4_decode_secinfo_no_name() function where the sin_exp field is initialized after decoding the sin_style field. When an XDR stream truncation occurs during decoding, the function returns nfserr_bad_xdr before sin_exp has been properly initialized, but the error cleanup path still attempts to process this uninitialized field through nfsd4_secinfo_no_name_release(). This release function calls exp_put() on what may contain stale union contents from a previous RPC call, as noted by the commit 3fdc54646234 that modified how the inline iops array is handled between operations.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially allowing authenticated attackers with NFS access to manipulate kernel memory structures through crafted RPC requests. This represents a classic buffer overread scenario where stale data from previous operations can be misinterpreted and processed as valid information during error recovery paths. The vulnerability is particularly concerning because it can occur in legitimate network traffic processing without requiring special privileges beyond NFS authentication, making it a significant concern for network services that rely on NFS implementations.
This issue demonstrates characteristics consistent with CWE-457: Use of Uninitialized Variable and CWE-129: Improper Validation of Array Index, where improper initialization creates conditions for memory access violations. The vulnerability aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation by providing a path through which an attacker could potentially escalate privileges within the kernel space through crafted NFS operations.
The mitigation strategy involves reordering the initialization sequence in the decode function to initialize sin_exp before any potentially failing decode operations, ensuring that error paths always operate on properly initialized data structures. This approach mirrors the established pattern used in nfsd4_decode_secinfo() function, creating consistency in the codebase's handling of similar scenarios. The fix effectively prevents stale data from being processed during cleanup operations and eliminates the potential for memory corruption through improper union handling in error recovery paths.