Look up another CVE · open CVE-2026-53395 in the interactive tracker

CVE-2026-53395

nfsd: fix dead ACL conflict guard in nfsd4_create

7.5 EPSS 0.4% AV:N

Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-53395 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.3-1	Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.3-1	Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/nfsd/nfs4proc.c

What this is: KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
Kernel module: nfsd

Check it on the machine

grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w nfsd

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_NFSD, CONFIG_NFSD_V4
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-19 (3 months ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.38%, higher than 30.7% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: fs/nfsd

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
7.0	7.1.3	8371cc5c0a2c
7.0	7.2	a60f25a80084

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: The vulnerability is reached through the in-kernel NFS server (nfsd) processing remotely submitted NFSv4 COMPOUND requests containing OP_CREATE over the network (TCP/2049).
AC:LAttack complexity, low: An attacker can reliably trigger the leak by sending CREATE operations with both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_DEFAULT/ACCESS_ACL set in the fattr bitmap; no race or uncontrollable conditions are required.
PR:NPrivileges required, none: Exploitation requires only network reachability to nfsd and standard NFSv4 client authentication to an export; no elevated Linux privileges on the server are needed beyond being an authorized NFS client.
UI:NUser interaction, none: The leak is triggered entirely by crafted NFS protocol requests with no action required from a human user on the server.
S:UScope, unchanged: Impact is confined to kernel memory exhaustion on the NFS server; it does not cross a security boundary such as a VM or sandbox escape.
C:NConfidentiality impact, none: The bug causes reference leaks of posix_acl slab objects only; there is no out-of-bounds access, use-after-free, or other memory corruption that could disclose data.
I:NIntegrity impact, none: No data modification or memory corruption occurs; the only effect is unreleased kernel heap allocations.
A:HAvailability impact, high: Each malicious CREATE leaks two posix_acl slab objects, and repeated requests cause unbounded slab exhaustion that can render the NFS server and potentially the entire host unavailable through OOM conditions.