CVE-2026-53026: Linux Kernel Privilege Escalation Flaw

CVE-2026-53026 Overview

CVE-2026-53026 is a Linux kernel vulnerability in the NFS server (NFSD) subsystem. The flaw resides in the nfsd4_add_rdaccess_to_wrdeleg function, where a race condition causes an extra increment of the nfs4_file access count. When fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access is incorrectly called again, leaving stale reference counts on nfs4_file objects. This prevents associated nfsd_file objects from being freed and triggers a BUG in kmem_cache_destroy() when stopping the nfs-server service. The issue is reproducible by running the Git project's test suite over NFS.

Critical Impact
A reference count leak in NFSD delegation handling prevents nfsd_file objects from being released, causing kernel BUG conditions when the NFS server service is stopped.

Affected Products

Linux kernel (mainline) NFSD subsystem
Stable kernel branches referenced in upstream fix commits
Systems running Linux NFS server with NFSv4 write delegations enabled

Discovery Timeline

2026-06-24 - CVE-2026-53026 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53026

Vulnerability Analysis

The vulnerability is a race condition [TOCTOU] in the NFSv4 delegation upgrade path. The function nfsd4_add_rdaccess_to_wrdeleg is responsible for adding READ access to a file that already has a WRITE delegation. Under concurrent execution, two threads can both observe that fp->fi_fds[O_RDONLY] requires initialization, but only one performs the assignment. The losing thread should skip the access count increment, yet the original code unconditionally invokes __nfs4_file_get_access, producing an extra reference on the nfs4_file structure.

This surplus fi_access count prevents the corresponding nfsd_file from ever reaching zero references. The leaked object remains attached to the kernel slab cache. When the NFS server service is stopped and the slab is torn down, kmem_cache_destroy() detects the residual objects and triggers a BUG in __kmem_cache_shutdown. The issue is observable on production systems and reproducible through the Git project's test suite executed over NFS.

Root Cause

The root cause is a missing conditional check around the access count increment. The code path assumed exclusive ownership of the fi_fds[O_RDONLY] slot but did not account for a peer thread completing the same initialization concurrently. Both threads then increment the access counter, while only one logical READ access was actually added.

Attack Vector

The issue is primarily a stability and resource management defect rather than a directly exploitable memory corruption flaw. Triggering the condition requires legitimate NFSv4 clients performing concurrent operations against a server that grants write delegations. The fix is delivered via the upstream commits 4584229395, b48f44f36e, and b81572b073.

Detection Methods for CVE-2026-53026

Indicators of Compromise

Kernel BUG messages referencing kmem_cache_destroy() or __kmem_cache_shutdown with nfsd_file objects remaining in the cache.
Persistent growth of nfsd_file slab objects visible in /proc/slabinfo on long-running NFS servers.
Failure or hang of nfs-server service shutdown sequences after sustained NFSv4 workloads.

Detection Strategies

Monitor kernel ring buffer output via dmesg for BUG or WARN messages originating from the NFSD subsystem during service restarts.
Track slabtop output for unbounded growth of nfsd_file and nfs4_file cache entries on NFS servers.
Audit running kernel versions against the patched stable releases to identify unpatched hosts.

Monitoring Recommendations

Enable kernel crash dump collection (kdump) on NFS servers to capture state when the BUG triggers.
Centralize syslog and kernel logs to a SIEM for correlation of slab cache anomalies across the NFS fleet.
Alert on systemd unit failure events for nfs-server.service stop operations.

How to Mitigate CVE-2026-53026

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 4584229395, b48f44f36e, and b81572b073 from the stable kernel tree.
Update to a distribution kernel package that includes the NFSD delegation fix once available from your vendor.
Schedule controlled reboots of NFS servers to load the patched kernel and clear any leaked slab state.

Patch Information

The vulnerability is resolved in the Linux stable kernel tree. The fix modifies nfsd4_add_rdaccess_to_wrdeleg so that __nfs4_file_get_access is invoked only when the calling thread is the one that installs fp->fi_fds[O_RDONLY]. Refer to the Kernel Git Commit 4584229395, Kernel Git Commit b48f44f36e, and Kernel Git Commit b81572b073 for the authoritative patches.

Workarounds

Disable NFSv4 write delegations on the server until the patched kernel is deployed by setting /proc/sys/fs/leases-enable to 0 where operationally acceptable.
Restrict NFS exports to trusted clients to limit concurrent delegation-triggering workloads.
Avoid restarting the nfs-server service on affected hosts when leaked nfsd_file objects are suspected, to prevent the kernel BUG path.

bash

# Disable file leases (and thus NFSv4 delegations) as a temporary workaround
echo 0 > /proc/sys/fs/leases-enable

# Verify the running kernel version against the patched stable release
uname -r

# Inspect NFSD-related slab caches for object accumulation
grep -E 'nfsd_file|nfs4_file' /proc/slabinfo