CVE-2026-53397: Linux Kernel Information Disclosure Bug

CVE-2026-53397 Overview

CVE-2026-53397 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw affects the SETACL procedure handlers for both NFSv2 ACL and NFSv3 ACL protocols. When nfsaclsvc_decode_setaclargs() or nfs3svc_decode_setaclargs() decode two Access Control Lists sequentially, a partial failure leaves an allocated posix_acl object orphaned. The kernel leaks this memory for the entire lifetime of the NFS server. Remote attackers with network access to the NFS service can trigger repeated leaks, exhausting kernel memory and causing denial of service.

Critical Impact
Remote unauthenticated attackers can exhaust kernel memory by repeatedly sending malformed NFS SETACL requests, causing denial of service on Linux NFS servers.

Affected Products

Linux kernel nfsd subsystem (NFSv2 ACL SETACL path)
Linux kernel nfsd subsystem (NFSv3 ACL SETACL path)
Multiple stable Linux kernel branches receiving backports (see referenced commits)

Discovery Timeline

2026-07-19 - CVE-2026-53397 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53397

Vulnerability Analysis

The vulnerability resides in the NFS server ACL decoding logic. Both nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() invoke nfs_stream_decode_acl() twice per request. The first call decodes the NFS_ACL field, the second decodes NFS_DFACL. Each successful call allocates a fresh posix_acl structure and assigns ownership to argp->acl_access or argp->acl_default.

When the first decode succeeds but the second fails, the decoder returns false without releasing the already allocated ACL. The kernel's RPC dispatcher, svc_process(), skips pc_func execution whenever pc_decode fails. The registered pc_release handlers, nfssvc_release_attrstat and nfs3svc_release_fhandle, only call fh_put() and have no knowledge of the ACL fields.

Root Cause

The cleanup logic for argp->acl_access and argp->acl_default was placed at the out: labels inside nfsacld_proc_setacl() and nfsd3_proc_setacl(). Because svc_process() skips pc_func when decode fails, those posix_acl_release() calls become unreachable. The orphaned posix_acl allocation is never freed, producing a kernel memory leak on every failed SETACL decode.

Attack Vector

Remote attackers with network reachability to the NFS server can send crafted NFSv2 or NFSv3 SETACL RPC requests. By ensuring the first ACL decodes successfully while the second decode fails, each request leaks one posix_acl object. Repeated requests progressively exhaust kernel memory, degrading system stability and eventually causing denial of service. The vulnerability requires no authentication and no user interaction.

The fix introduces dedicated nfsaclsvc_release_setacl() and nfs3svc_release_setacl() handlers. These new functions release both argp->acl_access and argp->acl_default alongside fh_put(). Wiring them as pc_release guarantees cleanup on every path svc_process() takes, including decode failure, matching the existing release_getacl() pattern.

Detection Methods for CVE-2026-53397

Indicators of Compromise

Steady, unexplained growth of kernel slab memory on hosts running nfsd with ACL support enabled
Elevated allocation counts in the posix_acl slab cache visible via /proc/slabinfo
Repeated malformed NFSv2 ACL or NFSv3 ACL SETACL RPC requests from the same client source
NFS server processes reporting ENOMEM or dispatcher decode failures in dmesg

Detection Strategies

Monitor slabtop and /proc/slabinfo for anomalous growth in posix_acl and related caches on NFS servers
Inspect NFS RPC traffic for a high ratio of SETACL calls returning decode errors
Correlate memory pressure events with the presence of nfsd threads and active NFSv3 ACL clients

Monitoring Recommendations

Track kernel memory metrics (MemAvailable, Slab, SReclaimable) over time on Linux NFS servers
Alert on sustained decreases in available kernel memory when workload has not changed
Capture packet traces of NFS ACL traffic during suspected exploitation windows for forensic analysis

How to Mitigate CVE-2026-53397

Immediate Actions Required

Apply the stable kernel updates that include the upstream fix referenced by commits 0853ac5, 136b416, 1e96239, 887f92c, a5b42c1, b2eb1ff, b94c4be, and bd69a82
Restrict access to NFS services (tcp/2049 and portmapper) to trusted network segments using host firewalls or network ACLs
Audit which servers export NFS with ACL support and prioritize patching internet-exposed or multi-tenant hosts

Patch Information

The fix is available across multiple Linux stable branches. Reference the upstream commits: Kernel Git Commit 0853ac5, Kernel Git Commit 136b416, Kernel Git Commit 1e96239, Kernel Git Commit 887f92c, Kernel Git Commit a5b42c1, Kernel Git Commit b2eb1ff, Kernel Git Commit b94c4be, and Kernel Git Commit bd69a82. Consult your distribution vendor for the specific package version that ships the backport.

Workarounds

Disable NFSv2 ACL and NFSv3 ACL support if not required by client workloads
Block untrusted networks from reaching the NFS RPC ports at the perimeter and host firewall
Restart nfsd on a schedule to reclaim leaked memory as a temporary measure until patches are applied

bash

# Restrict NFS access to a trusted subnet using nftables
nft add rule inet filter input ip saddr != 10.0.0.0/24 tcp dport 2049 drop
nft add rule inet filter input ip saddr != 10.0.0.0/24 udp dport 2049 drop

# Verify installed kernel version includes the fix
uname -r
rpm -q --changelog kernel | grep -i "posix_acl leak on SETACL"