CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix SECINFONONAME decode error cleanup
nfsd4decodesecinfononame() currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized.
Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFONONAME decode can therefore leave sinexp holding stale union contents from a previous operation.
The error response path still invokes nfsd4secinfononamerelease(), which calls expput() on a non-NULL sinexp.
Initialize sinexp before the first failable decode step, matching nfsd4decodesecinfo().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 3fdc54646234 - Compensating control
If the NFSD XDR stream can be truncated, ensure the decoder error/cleanup path is exercised safely so that SECINFO_NO_NAME decode error cleanup does not call exp_put() on non-NULL sin_exp with stale union contents.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53398?
CVE-2026-53398 has a critical severity rating of 9.8 on the CVSS scale.
How do I fix CVE-2026-53398?
To fix CVE-2026-53398, you should apply the latest patch for the Linux kernel that addresses the NFSD decode error.
What systems are affected by CVE-2026-53398?
CVE-2026-53398 affects systems running the vulnerable versions of the Linux kernel.
What type of vulnerability is CVE-2026-53398?
CVE-2026-53398 is a security vulnerability in the Linux kernel related to the NFSD component.
What are the potential impacts of CVE-2026-53398?
The potential impacts of CVE-2026-53398 include denial of service and a risk of unauthorized access due to improper handling of decoding errors.