Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-53396nfsd: fix posix_acl leak and ignored error in nfsd4_create_file

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.

Timeline

  1. ID reserved

    By Linux

  2. · 40 days later

    Published

  3. · 29 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-53396, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVDNVD · Analyzed3.1High7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS (exploitation in 30 days)
0.38% · top 68% of all CVEs (14 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Affected products

  • Linux · Linux

    • affected 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 – < 18cf006a08babec0bbac2a3784f8f28e56e47490
    • affected 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 – < 24c975bbdd564d7d0ad90294bfa69729830345de

  • Linux · Linux

    • affected 6.19
    • unaffected < 6.19
    • unaffected 7.1.3 – ≤ 7.1.*
    • unaffected 7.2 – ≤ *

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-53396 badge
[![CVE-2026-53396](https://cveledger.app/badge/CVE-2026-53396.svg)](https://cveledger.app/cve/CVE-2026-53396)

Record last updated .