Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component can cause system instability or crashes when the NFS service is stopped. This occurs because the system incorrectly tracks file access counts, preventing certain memory resources from being properly released. While it primarily affects system availability during maintenance or service restarts, it could potentially be used to exhaust system memory over time.
Technical details
A race condition in nfsd4_add_rdaccess_to_wrdeleg() within the NFSD implementation leads to an incorrect increment of the nfs4_file access count. Specifically, if multiple threads attempt to set READ access simultaneously, __nfs4_file_get_access may be called redundantly. This extra reference count prevents nfsd_file objects from being deallocated, eventually triggering a BUG in kmem_cache_destroy() during nfs-server service shutdown. The issue is reachable via network-based NFSv4 requests that trigger write delegation logic. Patches have been released for various stable kernel branches including 6.18.33 and 7.0.10.
Affected products
- Linux Linux Kernel 6.18.4 through 6.18.32, 6.19, 7.0.0 through 7.0.9
Timeline
- 2026-02-04: disclosed: Initial fix authored by Dai Ngo
- 2026-06-24: advisory: CVE-2026-53026 published by kernel.org and NVD