GHSA-X7F6-M4R7-Q3H7
Vulnerability from github – Published: 2026-07-19 12:30 – Updated: 2026-07-20 15:31In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
nfsd4_create_file() has two bugs in its ACL handling:
The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE.
When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX).
Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths to jump to out instead of out_write. Initialize child to ERR_PTR(-EINVAL) so that end_creating() is safe to call even if start_creating() was never reached.
{
"affected": [],
"aliases": [
"CVE-2026-53396"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T12:16:50Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak and ignored error in nfsd4_create_file\n\nnfsd4_create_file() has two bugs in its ACL handling:\n\nThe return value of nfsd4_acl_to_attr() is silently discarded. When\nthe NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for\nunsupported ACE types), the file is created without any ACL and the\nclient receives NFS4_OK. This violates RFC 7530/8881 which require\nthe server to reject unsupported attributes on CREATE.\n\nWhen start_creating() fails after ACL attributes have been populated\nin attrs (either via nfsd4_acl_to_attr or via ownership transfer from\nopen-\u003eop_dpacl/op_pacl), the function jumps to out_write which skips\nnfsd_attrs_free(). The posix_acl allocations are leaked. A client\ncan trigger this repeatedly with OPEN(CREATE), ACL attributes, and an\ninvalid filename (e.g., longer than NAME_MAX).\n\nFix both by capturing the nfsd4_acl_to_attr() return value and by\nchanging the early error paths to jump to out instead of out_write.\nInitialize child to ERR_PTR(-EINVAL) so that end_creating() is safe\nto call even if start_creating() was never reached.",
"id": "GHSA-x7f6-m4r7-q3h7",
"modified": "2026-07-20T15:31:45Z",
"published": "2026-07-19T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53396"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18cf006a08babec0bbac2a3784f8f28e56e47490"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24c975bbdd564d7d0ad90294bfa69729830345de"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.