CVE-2026-53395

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dead ACL conflict guard in nfsd4_create

nfsd4_create() steals create->cr_dpacl/cr_pacl into the local

nfsd_attrs via the designated initializer, then immediately sets the

source pointers to NULL. The subsequent conflict guard tests the

already-nilled source fields, making it permanently dead code:

if (create->cr_acl) {

if (create->cr_dpacl || create->cr_pacl) /* always false */

When a client encodes both FATTR4_WORD0_ACL and

FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr

bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without

releasing the originals, leaking two posix_acl slab objects per

request. Repeated requests cause unbounded slab exhaustion.

Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of

the nilled create->cr_dpacl/cr_pacl, matching the correct pattern

already used in nfsd4_setattr().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References