CVE-2026-53396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix posix_acl leak and ignored error in nfsd4_create_file

nfsd4_create_file() has two bugs in its ACL handling:

The return value of nfsd4_acl_to_attr() is silently discarded. When

the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for

unsupported ACE types), the file is created without any ACL and the

client receives NFS4_OK. This violates RFC 7530/8881 which require

the server to reject unsupported attributes on CREATE.

When start_creating() fails after ACL attributes have been populated

in attrs (either via nfsd4_acl_to_attr or via ownership transfer from

open->op_dpacl/op_pacl), the function jumps to out_write which skips

nfsd_attrs_free(). The posix_acl allocations are leaked. A client

can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an

invalid filename (e.g., longer than NAME_MAX).

Fix both by capturing the nfsd4_acl_to_attr() return value and by

changing the early error paths

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References