Executive brief
A vulnerability in the Linux kernel's file system handling could cause the system to fail to unlock certain directory resources during file creation errors. This affects systems using the Network File System (NFS) server (NFSD) when interacting with specific underlying filesystems. If triggered, this could lead to resource deadlocks or system instability, potentially impacting the availability of file services.
Technical details
A vulnerability exists in the Linux kernel Virtual File System (VFS) layer, specifically within the interaction between dentry_create() and nfsd4_create_file(). When NFSD exports a filesystem that supports atomic_create, and that function returns an error, dentry_create() may return an error pointer instead of a valid dentry. Because nfsd4_create_file() relies on a valid dentry to call end_creating() and unlock the parent directory, an error pointer causes the unlock sequence to be skipped. This results in a hung mount or directory lock. The fix ensures dentry_create() always maintains a valid dentry reference for the caller to perform necessary cleanup.
Affected products
- Linux Linux Kernel 7.0, 7.1
Timeline
- 2026-05-25: disclosed: Initial patch submission by NeilBrown
- 2026-06-19: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-06-25: advisory: CVE-2026-53244 published