Look up another CVE · open CVE-2026-53244 in the interactive tracker
CVE-2026-53244
VFS: fix possible failure to unlock in nfsd4_create_file()
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem fs. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53244 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
atomic_create() in fs/namei.c drops the reference to the dentry when it returns an error. This behaviour was imported into dentry_create() so that it will drop the reference if an error is returned from atomic_create(), though not if vfs_create() returns an error (in the case where ->atomic_create is not supported). The caller - nfsd4_create_file() - is made aware of this by checking path->dentry, which will either be a counted reference to a dentry, or an error pointer. However the change to use start_creating()/end_creating() (which landed shortly before the dentry_create() change landed, though was likely developed around the same time) means that nfsd4_create_file() *needs* a valid dentry so that it can unlock the parent. The net result is that if NFSD exports a filesystem which uses ->atomic_create, and if a call to ->atomic_create returns an error, then nfsd4_create_file() will pass an error pointer to end_creating() and the parent will not be unlocked. Fix this by changing dentry_create() to make sure path->dentry is always a valid dentry, never an error-pointer. The actual error is already returned a different way. Note that if ->atomic_create() returns a different dentry (which may not be possible in practice) we are guaranteed (because it is only ever provided by d_spliace_alias()) that it will have the same d_parent and so it will have the same effect when passed to end_creating().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/namei.c
- What this is
- FILESYSTEMS (VFS and infrastructure)MAINTAINERS section matched on fs/* · linux-fsdevel@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.34%, higher than 26.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.0 | 7.0.13 | ee1f40759a50 |
| 7.0 | 7.1 | e824bbd4d224 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable path is reachable through NFSv4 network COMPOUND/OPEN create requests handled by in-kernel nfsd.
- AC:LAttack complexity, low
- An attacker can directly send an OPEN create request to an affected export, and on atomic_open filesystems can choose inputs or conditions that make atomic_open return an error. No race or hard-to-control timing is required.
- PR:NPrivileges required, none
- In the highest reasonable deployment, a writable NFS export using AUTH_SYS/AUTH_NULL or host-based access lets a remote client reach this path without prior authenticated privileges. The attacker only needs network access to an export that permits creates.
- UI:NUser interaction, none
- No victim action is required after the NFS service and export are available; the attacker sends the NFS request directly.
- S:UScope, unchanged
- The impact is within the same kernel/NFS server security authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:NConfidentiality impact, none
- The bug leaves a directory lock held but does not expose kernel or file data and is not a memory corruption primitive.
- I:NIntegrity impact, none
- The flaw does not provide unauthorized modification of data or control flow; it causes failed cleanup after an atomic_open error.
- A:HAvailability impact, high
- Failure to unlock the parent directory i_rwsem can hang subsequent operations on that directory and can tie up nfsd service threads, producing a high-impact denial of service.