The Linux kernel's nfsd4_create() function mishandles ACL pointers by stealing create->cr_dpacl/cr_pacl into local attributes and then nullifying the source pointers before performing conflict checks. This results in the conflict guard condition always evaluating false, making the code that should prevent ACL conflicts dead. When a client sends a CREATE request encoding both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL attributes, nfsd4_acl_to_attr() overwrites existing ACL attributes without releasing the originals, leaking two posix_acl slab objects per request. Repeated exploitation can cause unbounded slab memory exhaustion. The fix involves checking the local stolen attributes (attrs.na_dpacl/na_pacl) instead of the nullified source pointers, aligning with the correct pattern used elsewhere in the code.

The vulnerability causes a memory leak of POSIX ACL objects in the kernel slab allocator when processing certain NFS CREATE requests. This can lead to unbounded slab exhaustion, potentially degrading system performance or causing denial of service due to resource exhaustion. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor for official kernel updates addressing CVE-2026-53395 and apply them promptly once available. No alternative mitigations are specified in the provided data.