Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-53244VFS: fix possible failure to unlock in nfsd4_create_file()

Description

In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to unlock in nfsd4_create_file() atomic_create() in fs/namei.c drops the reference to the dentry when it returns an error. This behaviour was imported into dentry_create() so that it will drop the reference if an error is returned from atomic_create(), though not if vfs_create() returns an error (in the case where ->atomic_create is not supported). The caller - nfsd4_create_file() - is made aware of this by checking path->dentry, which will either be a counted reference to a dentry, or an error pointer. However the change to use start_creating()/end_creating() (which landed shortly before the dentry_create() change landed, though was likely developed around the same time) means that nfsd4_create_file() *needs* a valid dentry so that it can unlock the parent. The net result is that if NFSD exports a filesystem which uses ->atomic_create, and if a call to ->atomic_create returns an error, then nfsd4_create_file() will pass an error pointer to end_creating() and the parent will not be unlocked. Fix this by changing dentry_create() to make sure path->dentry is always a valid dentry, never an error-pointer. The actual error is already returned a different way. Note that if ->atomic_create() returns a different dentry (which may not be possible in practice) we are guaranteed (because it is only ever provided by d_spliace_alias()) that it will have the same d_parent and so it will have the same effect when passed to end_creating().

Timeline

  1. ID reserved

    By Linux

  2. · 16 days later

    Published

  3. · 41 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-53244, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Analyzed3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
0.49% · top 57% of all CVEs (15 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

  • Linux · Linux

    • affected 64a989dbd144e0622371396461b11335459692d2 – < ee1f40759a50b1800c98c1c369afd5b3e44ad987
    • affected 64a989dbd144e0622371396461b11335459692d2 – < e824bbd4d224cce4b5fb59cc9dcd3447fe0b7e44

  • Linux · Linux

    • affected 7.0
    • unaffected < 7.0
    • unaffected 7.0.13 – ≤ 7.0.*
    • unaffected 7.1 – ≤ *

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-53244 badge
[![CVE-2026-53244](https://cveledger.app/badge/CVE-2026-53244.svg)](https://cveledger.app/cve/CVE-2026-53244)

Record last updated .