Look up another CVE · open CVE-2026-53396 in the interactive tracker

CVE-2026-53396

nfsd: fix posix_acl leak and ignored error in nfsd4_create_file

7.1 EPSS 0.3% AV:N

Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem fs/nfsd. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-53396 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.3-1	Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.3-1	Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/nfsd/nfs4proc.c

What this is: KERNEL NFSD, SUNRPC, AND LOCKD SERVERSMAINTAINERS section matched on fs/nfsd/ · linux-nfs@vger.kernel.org · Supported
Kernel module: nfsd

Check it on the machine

grep -wE 'CONFIG_NFSD|CONFIG_NFSD_V4' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w nfsd

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_NFSD, CONFIG_NFSD_V4
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-19 (3 months ago)source
CVSS: 7.1 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.30%, higher than 21.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: fs/nfsd

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.19	7.1.3	18cf006a08ba
6.19	7.2	24c975bbdd56

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: The vulnerable code is reached via NFSv4 OPEN(CREATE) handled by nfsd over the network (RPC on TCP/2049), from nfsd4_proc_compound() through nfsd4_open() and do_open_lookup() into nfsd4_create_file().
AC:LAttack complexity, low: An authenticated NFS client can reliably trigger the leak by sending OPEN(CREATE) with ACL attributes and a filename that causes start_creating() to fail (e.g., longer than the backing filesystem NAME_MAX); no race or attacker-uncontrollable conditions are required.
PR:LPrivileges required, low: Exploitation requires an authenticated NFS client with write/create permission on the target export directory (enforced by fh_verify()/nfsd_permission), which maps to basic authorized-user access rather than unauthenticated or server-admin privileges.
UI:NUser interaction, none: No victim interaction is needed beyond the attacker sending crafted NFSv4 compound requests to the server.
S:UScope, unchanged: Impact is confined to kernel memory management and exported file metadata within the NFS server's security authority; it does not cross VM, container, or IOMMU boundaries.
C:NConfidentiality impact, none: The bug is a refcount leak of posix_acl kernel objects with no out-of-bounds read, use-after-free, or other mechanism that exposes kernel memory to the attacker.
I:LIntegrity impact, low: The ignored nfsd4_acl_to_attr() error allows files to be created without the requested ACL while returning NFS4_OK, causing limited but incorrect modification of exported file security attributes on shared storage.
A:HAvailability impact, high: Repeated triggering leaks unbounded posix_acl slab objects per request, enabling sustained kernel memory exhaustion that can deny NFS service and degrade overall system availability.