CVE-2026-53396: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posixacl leak and ignored error in nfsd4createfile
nfsd4createfile() has two bugs in its ACL handling:
The return value of nfsd4acltoattr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE.
When startcreating() fails after ACL attributes have been populated in attrs (either via nfsd4acltoattr or via ownership transfer from open->opdpacl/oppacl), the function jumps to outwrite which skips nfsdattrsfree(). The posixacl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAMEMAX).
Fix both by capturing the nfsd4acltoattr() return value and by changing the early error paths to jump to out instead of outwrite. Initialize child to ERRPTR(-EINVAL) so that endcreating() is safe to call even if startcreating() was never reached.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel nfsd (nfsd4_create_file)to a version that resolves this vulnerability.Fixed in Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe
Event History
Frequently Asked Questions
Which systems are exposed to the memory-leak aspect of this issue?
Systems running an NFS server that accepts NFSv4 OPEN(CREATE) requests with ACL attributes are exposed. A client can repeatedly combine ACL attributes with an invalid filename, such as one longer than NAME_MAX, to trigger leaked POSIX ACL allocations.
What access does an attacker need?
The CVSS vector specifies low privileges and no user interaction, with network access. Exploitation requires an attacker to be able to send NFSv4 create requests to the affected NFS server.
What happens when ACL conversion fails?
Before the fix, an NFSv4-to-POSIX ACL conversion failure, such as -EINVAL for unsupported ACE types, can result in a file being created without an ACL while the client receives NFS4_OK. The fix returns the conversion error instead, rejecting unsupported attributes as required by the referenced RFC behavior.
What is the impact of repeated requests?
Repeated triggering can leak POSIX ACL allocations, which can consume memory and lead to an availability impact. The supplied CVSS vector rates availability impact as high and integrity impact as low.