CVE-2026-53395: Linux Kernel NFSD DoS Vulnerability

CVE-2026-53395 Overview

CVE-2026-53395 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) implementation. The flaw resides in the nfsd4_create() function, where a dead conflict guard fails to detect simultaneous encoding of NFSv4 and POSIX Access Control Lists (ACLs). When a client submits a CREATE request containing both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same fattr bitmap, the function leaks two posix_acl slab objects per request. Repeated malicious requests cause unbounded slab exhaustion, leading to denial of service on the NFS server.

Critical Impact
A remote unauthenticated attacker can exhaust kernel memory on an NFS server through repeated crafted CREATE requests, causing denial of service.

Affected Products

Linux kernel versions containing the vulnerable nfsd4_create() implementation
Systems providing NFSv4 file services with ACL support enabled
Distributions shipping affected upstream kernel releases prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-53395 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53395

Vulnerability Analysis

The vulnerability exists in the NFSv4 server code path handling file creation with ACL attributes. The nfsd4_create() function moves the caller-provided create->cr_dpacl and create->cr_pacl pointers into a local nfsd_attrs structure through a designated initializer, then nils the source pointers. A subsequent conflict guard checks the already-nilled source fields, rendering it permanently dead code.

The check if (create->cr_dpacl || create->cr_pacl) always evaluates to false because both pointers were reset to NULL earlier in the function. Consequently, when both NFSv4 ACL and POSIX ACL attributes coexist in the request, nfsd4_acl_to_attr() overwrites attrs.na_pacl and attrs.na_dpacl without releasing the originals.

Root Cause

The root cause is an ordering defect between pointer ownership transfer and conflict detection. After the designated initializer transfers ownership of the ACL pointers, the guard clause references the wrong variables. This categorizes the flaw as a memory leak leading to resource exhaustion denial of service.

Attack Vector

An attacker with network access to an NFSv4 export can craft CREATE operations that simultaneously encode NFSv4 ACL and POSIX default/access ACL attributes in the same fattr bitmap. Each request leaks two posix_acl slab allocations. Sustained request volume drives unbounded kernel slab consumption until the system becomes unresponsive.

The vulnerability manifests during protocol-level attribute processing. See the kernel commit details for the corrected logic that inspects attrs.na_dpacl and attrs.na_pacl instead of the nilled source fields, mirroring the pattern already used in nfsd4_setattr().

Detection Methods for CVE-2026-53395

Indicators of Compromise

Sustained growth in posix_acl slab cache allocations visible in /proc/slabinfo without corresponding release
Repeated NFSv4 CREATE operations from a single client encoding both NFSv4 and POSIX ACL bitmaps
Kernel memory pressure warnings or out-of-memory events on hosts running nfsd

Detection Strategies

Monitor posix_acl slab object counts over time and alert on abnormal upward trends on NFS servers
Inspect NFSv4 packet captures for CREATE requests carrying both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_*_ACL bits set concurrently
Correlate NFS request rates with kernel slab growth to identify abusive clients

Monitoring Recommendations

Track kernel memory metrics through node exporters and alert on sustained slab consumption growth
Enable NFS server audit logging to capture client identities issuing high-volume CREATE traffic
Baseline normal ACL usage patterns to distinguish legitimate workloads from exhaustion attempts

How to Mitigate CVE-2026-53395

Immediate Actions Required

Apply the upstream kernel fix that checks attrs.na_dpacl and attrs.na_pacl instead of the nilled source pointers
Restrict NFSv4 export access to trusted network segments using firewall rules and /etc/exports host restrictions
Monitor NFS server slab caches for abnormal growth and be prepared to restart affected services

Patch Information

The issue is resolved in upstream Linux kernel commits 8371cc5c0a2c and a60f25a80084. Administrators should update to kernel builds incorporating these commits or apply distribution backports as they become available.

Workarounds

Disable NFSv4 ACL support where operationally acceptable to eliminate the vulnerable code path
Limit NFS server exposure through network segmentation and VPN-only access controls
Implement rate limiting on NFS traffic at network boundaries to slow exhaustion attempts

bash

# Restrict NFS exports to trusted subnets in /etc/exports
/srv/nfs  10.0.0.0/24(rw,sync,no_subtree_check)

# Reload exports after modification
exportfs -ra

# Monitor posix_acl slab consumption
watch -n 5 'grep posix_acl /proc/slabinfo'