Look up another CVE · open CVE-2026-53394 in the interactive tracker
CVE-2026-53394
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53394 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.95-1 | Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Control then falls through past the `if (oo)` guard -- which would have freed any pre-allocated `new` -- and unconditionally executes `new = alloc_stateowner(...)`. If `new` was already allocated on a prior iteration, the pointer is silently overwritten and the previous allocation (slab object + owner name buffer) is leaked. This requires a race: two NFSv4.0 OPEN threads with the same owner string, where a concurrent thread inserts a new unconfirmed owner into the hash between retry iterations. The window is narrow but repeatable under adversarial conditions. Fix by adding `goto retry` after `oo = NULL` so the already-allocated `new` is reused on the next iteration rather than overwritten.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/nfsd/nfs4state.c
- What this is
- KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
- Kernel module
- nfsd
Check it on the machine
grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nfsdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NFSD, CONFIG_NFSD_V4
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.46%, higher than 38.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/nfsd
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.10 | 6.12.95 | c9aefb2b5f11 |
| 6.10 | 6.18.38 | 017a6150106b |
| 6.10 | 7.1.3 | a10bf67fe064 |
| 6.10 | 7.2 | 57aee7a35bb1 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The flaw is in nfsd's NFSv4 OPEN handling, reachable remotely via NFS RPC on TCP/UDP port 2049 through svc_recv → NFSPROC4_COMPOUND → nfsd4_open → nfsd4_process_open1 → find_or_alloc_open_stateowner().
- AC:LAttack complexity, low
- Exploitation requires a race between two NFSv4.0 OPEN requests with the same owner string, but the attacker controls both sides by issuing concurrent compounds from multiple connections; the fix commit itself states this is repeatable under adversarial conditions.
- PR:NPrivileges required, none
- No local privileges on the server are required—only remote NFSv4 client access to establish a clientid (SETCLIENTID/CONFIRM) and send concurrent OPEN operations; the leak occurs in nfsd4_process_open1 before export/file permission checks complete.
- UI:NUser interaction, none
- Exploitation is fully automated via concurrent NFS protocol requests and requires no action from any victim user on the server or client side.
- S:UScope, unchanged
- Impact is confined to kernel memory consumption within nfsd's security authority; there is no cross-boundary escape to other components or privilege domains.
- C:NConfidentiality impact, none
- This is a pure memory leak where orphaned slab objects lose all kernel references; no out-of-bounds read, use-after-free, or other mechanism exposes kernel data to the attacker.
- I:NIntegrity impact, none
- The bug silently drops a pointer to an allocated object without corrupting adjacent memory or providing any write or control-flow primitive—only heap memory is lost.
- A:HAvailability impact, high
- Each successful race leaks a slab object plus an attacker-controlled owner-name buffer (up to NFS4_OPAQUE_LIMIT bytes), and the attack can be repeated indefinitely to cause unbounded kernel memory exhaustion, denying NFS service and potentially triggering system-wide OOM conditions.