CVE-2026-53244

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

VFS: fix possible failure to unlock in nfsd4_create_file()

atomic_create() in fs/namei.c drops the reference to the dentry

when it returns an error.

This behaviour was imported into dentry_create() so that it

will drop the reference if an error is returned from atomic_create(),

though not if vfs_create() returns an error (in the case where

->atomic_create is not supported).

The caller - nfsd4_create_file() - is made aware of this by checking

path->dentry, which will either be a counted reference to a dentry, or

an error pointer.

However the change to use start_creating()/end_creating() (which landed

shortly before the dentry_create() change landed, though was likely

developed around the same time) means that nfsd4_create_file() *needs* a

valid dentry so that it can unlock the parent.

The net result is that if NFSD exports a filesystem which uses

->atomic_create, and if a call to ->atomic_create returns an error, t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References