In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file… (CVE-2026-53396)
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.
AI Analysis
Technical Summary
The Linux kernel's nfsd4_create_file() function had two bugs related to ACL handling. First, the return value of nfsd4_acl_to_attr() was discarded, so when ACL conversion failed (e.g., due to unsupported ACE types), the server created files without ACLs but returned success to the client, violating RFC 7530/8881. Second, if start_creating() failed after ACL attributes were set, the function skipped freeing allocated POSIX ACLs, causing a memory leak. Clients could repeatedly trigger this leak by issuing OPEN(CREATE) requests with ACL attributes and invalid filenames. The fix involved checking the return value of nfsd4_acl_to_attr() and correcting error handling paths to properly free resources.
Potential Impact
The vulnerability causes the NFS server to violate protocol requirements by accepting unsupported ACL attributes silently, potentially leading to inconsistent ACL enforcement. The memory leak could be exploited by a client to exhaust server resources by repeatedly triggering the error condition. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address these issues by properly handling ACL conversion errors and ensuring allocated ACL memory is freed on error paths. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. Patch status is not explicitly stated; check the official Linux kernel advisories or vendor updates for the fixed versions.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file… (CVE-2026-53396)
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.
CVSS v3.1
Score 7.1high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's nfsd4_create_file() function had two bugs related to ACL handling. First, the return value of nfsd4_acl_to_attr() was discarded, so when ACL conversion failed (e.g., due to unsupported ACE types), the server created files without ACLs but returned success to the client, violating RFC 7530/8881. Second, if start_creating() failed after ACL attributes were set, the function skipped freeing allocated POSIX ACLs, causing a memory leak. Clients could repeatedly trigger this leak by issuing OPEN(CREATE) requests with ACL attributes and invalid filenames. The fix involved checking the return value of nfsd4_acl_to_attr() and correcting error handling paths to properly free resources.
Potential Impact
The vulnerability causes the NFS server to violate protocol requirements by accepting unsupported ACL attributes silently, potentially leading to inconsistent ACL enforcement. The memory leak could be exploited by a client to exhaust server resources by repeatedly triggering the error condition. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address these issues by properly handling ACL conversion errors and ensuring allocated ACL memory is freed on error paths. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. Patch status is not explicitly stated; check the official Linux kernel advisories or vendor updates for the fixed versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x7f6-m4r7-q3h7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53396"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ad2a4a8d5989131f54
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:22:48 UTC
Last updated: 09/03/2026, 10:52:10 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.