Junglewise Threat Intelligence

CVE-2026-53397: Linux Kernel nfsd memory leak in SETACL decode failure

CVE-2026-53397 · Severity: info · CVSS 4 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a remote user to cause a memory leak. By sending specifically crafted requests that fail during processing, an attacker can cause the server to fail to release memory associated with Access Control Lists (ACLs). Over time, this could exhaust available system memory, potentially leading to a service outage or system instability.

Technical details

A memory leak exists in the Linux kernel's nfsd (NFS server) implementation within the nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() functions. These functions call nfs_stream_decode_acl() twice to handle NFS_ACL and NFS_DFACL. If the first call succeeds but the second fails, the decoder returns false, causing the RPC layer to skip the procedure function (pc_func) where cleanup was originally located. Because the default release functions (nfssvc_release_attrstat and nfs3svc_release_fhandle) were unaware of the allocated posix_acl structures, the memory remains leaked for the lifetime of the server. An attacker can trigger this by sending a SETACL request with a valid first ACL but a malformed second ACL. The fix introduces specific release functions that properly free both ACL fields during the pc_release phase, which is executed regardless of decode success or failure.

Affected products

  • Linux Linux Kernel versions prior to fixed stable releases (e.g., 6.10, 6.9.4, etc.)

Timeline

  • 2026-05-21: disclosed: Initial patch authored by Jeff Layton
  • 2026-07-19: advisory: CVE-2026-53397 published in NVD

References

Related threats