CVE-2026-53398: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53398 Overview

CVE-2026-53398 is a Linux kernel vulnerability in the NFS server (NFSD) subsystem. The flaw resides in nfsd4_decode_secinfo_no_name(), which fails to initialize the sin_exp field before invoking failable XDR decode steps. When the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized, leaving the field populated with stale union contents from a previous NFSv4 compound operation.

The error response path subsequently calls nfsd4_secinfo_no_name_release(), which invokes exp_put() on the stale pointer. This creates a path for reference count corruption or memory safety violations reachable over the network by any NFSv4 client.

Critical Impact
A remote, unauthenticated attacker can send a malformed NFSv4 SECINFO_NO_NAME request to trigger exp_put() on stale kernel memory, potentially resulting in kernel memory corruption or denial of service.

Affected Products

Linux kernel builds containing NFSD with the SECINFO_NO_NAME decoder
Kernel versions after commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing")
Any distribution shipping unpatched kernels with NFSv4 server enabled

Discovery Timeline

2026-07-19 - CVE-2026-53398 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53398

Vulnerability Analysis

The vulnerability is a use of uninitialized memory in the NFSv4 XDR decoding path within the Linux kernel NFS server. The function nfsd4_decode_secinfo_no_name() decodes the sin_style field before setting sin_exp to a known-safe value. If the XDR stream is truncated during decode, the function returns an error while sin_exp still contains residual data from a prior compound operation slot.

Because of the earlier optimization in commit 3fdc54646234, the inline iops array is no longer cleared between RPC calls. This means the union backing sin_exp can carry pointer-shaped values from previous NFSv4 operations executed in the same argument buffer.

On the error path, nfsd4_secinfo_no_name_release() sees a non-NULL sin_exp and calls exp_put() on it. This decrements the reference count of an export structure that was never acquired by this operation, corrupting kernel state.

Root Cause

The root cause is improper initialization ordering combined with removed defensive zeroing of argument structures. The decoder must set sin_exp = NULL before any failable step so that the release helper can safely distinguish an acquired export from an uninitialized field.

Attack Vector

The attack is network-reachable and requires no authentication when the NFS server accepts anonymous or AUTH_SYS traffic. An attacker sends a crafted NFSv4 COMPOUND request containing a SECINFO_NO_NAME operation preceded by an operation that leaves attacker-influenced content in the shared argument buffer. The SECINFO_NO_NAME payload is then truncated to force the early error return before sin_exp initialization.

Exploitation code is not available in the enriched data. See the upstream kernel commits linked below for the precise decoder logic and patch semantics.

Detection Methods for CVE-2026-53398

Indicators of Compromise

Unexpected kernel oops or general protection fault messages referencing exp_put, nfsd4_secinfo_no_name_release, or nfsd4_decode_secinfo_no_name in dmesg or /var/log/messages.
NFSD reference counting warnings or refcount_t: underflow splats correlated with NFSv4 client traffic.
Sudden NFS service instability, mount stalls, or export table inconsistencies without administrative changes.

Detection Strategies

Monitor kernel ring buffer output on NFS servers for stack traces originating in fs/nfsd/nfs4xdr.c decode paths.
Inspect NFSv4 traffic with packet capture to identify truncated COMPOUND requests containing SECINFO_NO_NAME operations.
Compare running kernel version and vendor patch level against the fixing commits published on git.kernel.org.

Monitoring Recommendations

Enable auditd rules for kernel taint state changes and unexpected NFSD daemon restarts.
Forward dmesg and journald kernel facility logs to a centralized SIEM for correlation across NFS server fleets.
Track anomalous NFSv4 client source addresses issuing high volumes of malformed compound requests.

How to Mitigate CVE-2026-53398

Immediate Actions Required

Apply the vendor-supplied Linux kernel update that includes the upstream fix initializing sin_exp before failable decode steps.
If patching is not immediately possible, restrict NFSv4 access at the network layer to trusted client subnets using firewall rules on TCP/UDP port 2049.
Audit exported filesystems and remove exports that do not require NFSv4 access to reduce the attack surface.

Patch Information

The upstream fix is available across multiple stable branches. Reference the following kernel commits for the corrective patch:

The patch initializes sin_exp to NULL before the first failable decode step, matching the behavior already present in nfsd4_decode_secinfo().

Workarounds

Disable the NFSv4 server (nfsd) on hosts that only serve NFSv3 clients by adjusting /etc/nfs.conf or the equivalent distribution configuration.
Enforce Kerberos authentication (sec=krb5) on all NFSv4 exports to eliminate anonymous access paths.
Place NFS servers behind an internal firewall and drop NFSv4 traffic from any source outside the authorized management VLAN.

bash

# Example: restrict NFSv4 access with firewalld until the kernel is patched
sudo firewall-cmd --permanent --zone=drop --add-service=nfs
sudo firewall-cmd --permanent --zone=internal --add-service=nfs
sudo firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/24
sudo firewall-cmd --reload

# Verify the running kernel version against the patched build
uname -r