Linux Kernel up to 7.1.2/7.2 Nfsd nfsd4_create cr_dpacl/cr_pacl memory leak

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.2/7.2 and classified as critical. Impacted is the function nfsd4_create of the component Nfsd. Such manipulation of the argument cr_dpacl/cr_pacl leads to memory leak. This vulnerability is uniquely identified as CVE-2026-53395. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.2/7.2. It has been rated as critical. Affected by this issue is the function nfsd4_create of the component Nfsd. The manipulation of the argument cr_dpacl/cr_pacl with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-53395 since 06/09/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 328318 (Linux Distros Unpatched Vulnerability : CVE-2026-53395), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.1.3 or 7.2-rc1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (328318) and CERT Bund (WID-SEC-2026-2403). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• RESF Rocky Linux
• SUSE openSUSE
• Ubuntu Linux
• Oracle Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0
• 7.1
• 7.1.0
• 7.1.1
• 7.1.2
• 7.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion