In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file… (CVE-2026-53396)
A vulnerability in the Linux kernel's NFS server (nfsd) was fixed involving improper handling of POSIX ACLs in the nfsd4_create_file function. The issue caused the server to ignore errors during ACL conversion, leading to files being created without ACLs while incorrectly signaling success to clients, violating NFS protocol specifications. Additionally, a memory leak occurred when certain errors caused allocated ACL structures to not be freed. This flaw could be triggered by clients using invalid filenames with ACL attributes.
AI Analysis
Technical Summary
The Linux kernel's nfsd4_create_file() function had two bugs related to ACL handling. First, the return value of nfsd4_acl_to_attr() was discarded, so when ACL conversion failed (e.g., due to unsupported ACE types), the server created files without ACLs but returned success to the client, violating RFC 7530/8881. Second, if start_creating() failed after ACL attributes were set, the function skipped freeing allocated POSIX ACLs, causing a memory leak. Clients could repeatedly trigger this leak by issuing OPEN(CREATE) requests with ACL attributes and invalid filenames. The fix involved checking the return value of nfsd4_acl_to_attr() and correcting error handling paths to properly free resources.
Potential Impact
The vulnerability causes the NFS server to violate protocol requirements by accepting unsupported ACL attributes silently, potentially leading to inconsistent ACL enforcement. The memory leak could be exploited by a client to exhaust server resources by repeatedly triggering the error condition. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address these issues by properly handling ACL conversion errors and ensuring allocated ACL memory is freed on error paths. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. Patch status is not explicitly stated; check the official Linux kernel advisories or vendor updates for the fixed versions.
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file… (CVE-2026-53396)
Description
A vulnerability in the Linux kernel's NFS server (nfsd) was fixed involving improper handling of POSIX ACLs in the nfsd4_create_file function. The issue caused the server to ignore errors during ACL conversion, leading to files being created without ACLs while incorrectly signaling success to clients, violating NFS protocol specifications. Additionally, a memory leak occurred when certain errors caused allocated ACL structures to not be freed. This flaw could be triggered by clients using invalid filenames with ACL attributes.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's nfsd4_create_file() function had two bugs related to ACL handling. First, the return value of nfsd4_acl_to_attr() was discarded, so when ACL conversion failed (e.g., due to unsupported ACE types), the server created files without ACLs but returned success to the client, violating RFC 7530/8881. Second, if start_creating() failed after ACL attributes were set, the function skipped freeing allocated POSIX ACLs, causing a memory leak. Clients could repeatedly trigger this leak by issuing OPEN(CREATE) requests with ACL attributes and invalid filenames. The fix involved checking the return value of nfsd4_acl_to_attr() and correcting error handling paths to properly free resources.
Potential Impact
The vulnerability causes the NFS server to violate protocol requirements by accepting unsupported ACL attributes silently, potentially leading to inconsistent ACL enforcement. The memory leak could be exploited by a client to exhaust server resources by repeatedly triggering the error condition. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address these issues by properly handling ACL conversion errors and ensuring allocated ACL memory is freed on error paths. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, patching the kernel is the recommended remediation. Patch status is not explicitly stated; check the official Linux kernel advisories or vendor updates for the fixed versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x7f6-m4r7-q3h7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53396"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27ad2a4a8d5989131f54
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:22:48 UTC
Last updated: 07/20/2026, 17:26:47 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.