CVE-2026-53396: Linux Kernel Information Disclosure Bug

CVE-2026-53396 Overview

CVE-2026-53396 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw resides in nfsd4_create_file(), which mishandles POSIX Access Control List (ACL) attributes during NFSv4 file creation operations. Two distinct bugs coexist: the function silently discards the return value of nfsd4_acl_to_attr(), and it leaks posix_acl allocations when start_creating() fails after ACL attributes have been populated. A remote authenticated NFSv4 client can repeatedly trigger the leak using OPEN(CREATE) requests carrying ACL attributes and an invalid filename, exhausting kernel memory.

Critical Impact
An authenticated NFSv4 client can repeatedly exhaust kernel memory through posix_acl leaks and can create files without the requested ACLs while receiving NFS4_OK, violating RFC 7530/8881 semantics.

Affected Products

Linux kernel nfsd subsystem (NFSv4 server)
Distributions shipping vulnerable stable kernels prior to the fix commits 18cf006a08ba and 24c975bbdd56
Any system exporting NFSv4 shares with ACL support enabled

Discovery Timeline

2026-07-19 - CVE-2026-53396 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53396

Vulnerability Analysis

The defect lives in nfsd4_create_file(), part of the Linux NFSv4 server. The function accepts ACL attributes from the client during an OPEN(CREATE) operation and calls nfsd4_acl_to_attr() to convert NFSv4 ACLs into POSIX ACLs. The return value of that conversion is silently discarded. When the conversion fails, for example with -EINVAL for unsupported Access Control Entry (ACE) types, the file is still created without any ACL and the client receives NFS4_OK. This violates RFC 7530 and RFC 8881, which require the server to reject unsupported attributes on CREATE.

The second bug is a memory leak. If start_creating() fails after ACL attributes have been populated in attrs — either through nfsd4_acl_to_attr() or via ownership transfer from open->op_dpacl and op_pacl — the function jumps to the out_write label. That path skips nfsd_attrs_free(), so the posix_acl allocations are never released. The upstream fix captures the return value of nfsd4_acl_to_attr(), redirects early error paths to the out label, and initializes child to ERR_PTR(-EINVAL) so end_creating() is safe to call.

Root Cause

The root cause is improper error handling in kernel resource cleanup logic. nfsd4_create_file() failed to check the ACL conversion result and used an incorrect goto target for early failures, leaving allocated posix_acl structures unreferenced. This combines an ignored return value with a memory leak on the error path.

Attack Vector

An authenticated remote client with access to an NFSv4 export can craft an OPEN(CREATE) request that supplies ACL attributes together with a filename longer than NAME_MAX. start_creating() rejects the invalid name after nfsd4_acl_to_attr() has already populated attrs, and the leak path is taken. Repeating the request drives kernel memory exhaustion, producing a denial-of-service condition on the file server. The silently ignored conversion error also lets clients create files without the ACLs they requested.

See the upstream fixes for technical details: Kernel commit 18cf006a08ba and Kernel commit 24c975bbdd56.

Detection Methods for CVE-2026-53396

Indicators of Compromise

Sustained growth of kernel slab caches associated with posix_acl allocations without matching frees, visible in /proc/slabinfo.
Repeated NFSv4 OPEN operations from a single client carrying ACL attributes and filenames exceeding NAME_MAX, returning name-related errors.
Unexpected memory pressure or out-of-memory events on NFS servers that correlate with elevated NFSv4 traffic.

Detection Strategies

Monitor nfsd operation counters and correlate spikes in failed OPEN(CREATE) responses with kernel memory growth over time.
Audit created files on NFS-exported filesystems for missing or unexpected ACLs following NFSv4 CREATE operations that included ACL attributes.
Capture NFSv4 traffic and flag OPEN(CREATE) calls whose component name length exceeds 255 bytes combined with NFS4_ACL attribute presence.

Monitoring Recommendations

Track Slab and SReclaimable values in /proc/meminfo on NFS servers and alert on abnormal upward trends.
Aggregate NFS server telemetry into a centralized data lake to correlate client behavior, error rates, and kernel memory consumption.
Alert on kernel messages related to nfsd, ACL processing, and memory allocation failures.

How to Mitigate CVE-2026-53396

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 18cf006a08ba and 24c975bbdd56 as soon as vendor packages are available.
Restrict NFSv4 exports to trusted client networks using firewall rules and exports(5) host restrictions until patches are deployed.
Inventory NFS servers and identify systems exporting shares with ACL support to prioritize remediation.

Patch Information

The fix is available in the mainline Linux kernel through two commits. The first commit captures the return value of nfsd4_acl_to_attr() and routes early error paths to a label that calls nfsd_attrs_free(). The second commit initializes child to ERR_PTR(-EINVAL) so end_creating() remains safe when start_creating() was never reached. Consult Kernel commit 18cf006a08ba and Kernel commit 24c975bbdd56 and pick up the vendor-backported kernel package for your distribution.

Workarounds

Disable NFSv4 ACL support on exports where it is not required by removing the acl mount and export options.
Limit NFSv4 access to authenticated clients over Kerberos (sec=krb5) and to defined subnets to reduce exposure.
Rate-limit or block clients that generate high volumes of failed OPEN(CREATE) operations at the network layer.

bash

# Example: restrict an NFSv4 export to a trusted subnet without ACL support
# /etc/exports
/srv/nfs4  10.0.10.0/24(rw,sync,no_subtree_check,sec=krb5,no_acl)

# Apply and verify
exportfs -ra
exportfs -v