In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name()… (CVE-2026-53398)
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().
AI Analysis
Technical Summary
The Linux kernel's NFSD component had a flaw in the nfsd4_decode_secinfo_no_name() function where the sin_exp variable was initialized after decoding sin_style. If the XDR stream was truncated, the decoder returned an error before sin_exp was initialized. Due to a previous change that stopped clearing the inline iops array between RPC calls, a failed decode could leave sin_exp containing stale union data. The error handling path would then call exp_put() on this non-NULL, stale sin_exp, potentially causing improper resource handling. The fix involved initializing sin_exp before the first decode step, aligning with the behavior in nfsd4_decode_secinfo().
Potential Impact
The vulnerability could cause improper cleanup of resources due to stale data usage in error handling within the NFS server code. While no direct exploit or impact such as privilege escalation or denial of service is documented, the flaw could lead to inconsistent state or resource management issues in the kernel's NFS server component.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel source code. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is released. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name()… (CVE-2026-53398)
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().
CVSS v3.1
Score 9.8critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's NFSD component had a flaw in the nfsd4_decode_secinfo_no_name() function where the sin_exp variable was initialized after decoding sin_style. If the XDR stream was truncated, the decoder returned an error before sin_exp was initialized. Due to a previous change that stopped clearing the inline iops array between RPC calls, a failed decode could leave sin_exp containing stale union data. The error handling path would then call exp_put() on this non-NULL, stale sin_exp, potentially causing improper resource handling. The fix involved initializing sin_exp before the first decode step, aligning with the behavior in nfsd4_decode_secinfo().
Potential Impact
The vulnerability could cause improper cleanup of resources due to stale data usage in error handling within the NFS server code. While no direct exploit or impact such as privilege escalation or denial of service is documented, the flaw could lead to inconsistent state or resource management issues in the kernel's NFS server component.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel source code. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is released. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hfvv-wwwp-6wgr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53398"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ad2a4a8d5989132285
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:23:43 UTC
Last updated: 09/03/2026, 22:52:12 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.