CVE-2026-53244: Linux Kernel Privilege Escalation Flaw

CVE-2026-53244 Overview

CVE-2026-53244 affects the Linux kernel's Virtual File System (VFS) layer and the NFS daemon (NFSD) subsystem. The flaw resides in nfsd4_create_file() where a parent directory may remain locked after a failed ->atomic_create operation. When NFSD exports a filesystem implementing ->atomic_create and that callback returns an error, dentry_create() passes an error pointer to end_creating(), preventing the parent dentry from being unlocked. The result is a kernel locking inconsistency that can stall NFS file creation operations on the affected mount.

Critical Impact
A failed ->atomic_create call through NFSD leaves the parent directory locked, leading to potential denial of service on NFS-exported filesystems.

Affected Products

Linux kernel (mainline) — VFS and NFSD subsystems
Linux stable branches receiving the referenced backports
NFS server deployments exporting filesystems that implement ->atomic_create

Discovery Timeline

2026-06-25 - CVE-2026-53244 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53244

Vulnerability Analysis

The vulnerability is a locking error in the Linux kernel VFS path used by NFSD during file creation over NFSv4. The function atomic_create() in fs/namei.c releases the dentry reference when it returns an error. This behavior was carried into dentry_create(), which drops the reference on ->atomic_create errors but not on vfs_create() errors.

The caller nfsd4_create_file() distinguishes the two outcomes by inspecting path->dentry, which is either a valid counted reference or an error pointer. A separate refactor introduced start_creating() and end_creating() helpers around the same time. The end_creating() helper requires a valid dentry to unlock the parent inode.

When NFSD exports a filesystem that supplies an ->atomic_create operation, and that callback returns an error, nfsd4_create_file() ends up passing an error pointer to end_creating(). The parent directory remains locked, blocking subsequent operations against that directory.

Root Cause

The root cause is an interface contract mismatch between dentry_create() and end_creating(). The former can return through path->dentry either a valid dentry or an ERR_PTR. The latter assumes a valid dentry to perform inode_unlock() on the parent. The fix updates dentry_create() so path->dentry is always a valid dentry, with the actual error returned through a separate return value. This falls under [CWE-667] (Improper Locking) characteristics.

Attack Vector

Triggering the condition requires an NFSv4 client to request a file creation on an exported filesystem whose ->atomic_create callback returns an error. The error path then leaves the parent inode locked. The vulnerability is local to the kernel logic but reachable through any authenticated NFSv4 client that can issue OPEN/CREATE operations against such an export. The fix is provided in upstream kernel commits — see the Kernel Git Commit Report (ee1f40) and the Kernel Git Commit Report (e824bb).

No public proof-of-concept code is available. The vulnerability mechanism is described in prose only; refer to the upstream commits for the corrected dentry handling logic.

Detection Methods for CVE-2026-53244

Indicators of Compromise

NFS client operations against a specific exported directory hang indefinitely after a failed create operation.
Kernel processes blocked in D state waiting on an inode rwsem held by an earlier NFSD worker.
hung task warnings in dmesg referencing nfsd4_create_file or end_creating call paths.

Detection Strategies

Monitor /proc/<pid>/stack for NFSD threads stuck on inode_lock after CREATE operations.
Audit kernel logs for repeated INFO: task ... blocked for more than N seconds entries originating from NFSD worker threads.
Track NFSv4 server-side error rates for OPEN with CREATE — sustained error spikes against a single export warrant investigation.

Monitoring Recommendations

Enable kernel.hung_task_timeout_secs reporting and forward dmesg output to a central log store for correlation.
Instrument NFSD operation counters via /proc/net/rpc/nfsd to detect anomalous backlogs.
Inventory exported filesystems and identify those whose drivers implement ->atomic_create to prioritize monitoring.

How to Mitigate CVE-2026-53244

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and rebuild affected kernels.
Identify NFS exports backed by filesystems implementing ->atomic_create and schedule them for early patching.
Restart NFSD or reboot affected hosts after patching to clear any residual locked inodes.

Patch Information

The fix modifies dentry_create() so path->dentry is always a valid dentry, never an error pointer, allowing end_creating() to safely unlock the parent. The actual error value is returned through a distinct channel. Patch commits are available at the Kernel Git Commit Report (ee1f40) and the Kernel Git Commit Report (e824bb). Distribution-specific backports should be tracked through vendor advisories.

Workarounds

Restrict NFS exports to filesystems that do not implement ->atomic_create until patches are deployed.
Limit NFSv4 client access using firewall rules and exportfs ACLs to reduce exposure to untrusted requesters.
Monitor for hung NFSD tasks and restart the NFS service when the locked-parent condition is observed to restore availability.

bash

# Verify running kernel and check for the patched commit
uname -r

# List exported filesystems to identify candidates for review
exportfs -v

# Inspect NFSD worker thread states for blocked tasks
for pid in $(pgrep nfsd); do echo "=== $pid ==="; cat /proc/$pid/stack; done

# Increase visibility of hung-task warnings
sysctl -w kernel.hung_task_timeout_secs=60