CVE-2026-53397 Linux CVE debrief

Who should care

Linux kernel users and administrators, particularly those managing systems with nfsd deployments, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system configurations, updating to the latest kernel versions, and monitoring for suspicious activity related to nfsd.

Technical summary

The Linux kernel's nfsd has a vulnerability that causes a posix_acl leak on SETACL decode failure. This occurs because nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() call nfs_stream_decode_acl() twice. If the first call succeeds and the second fails, the decoder returns false, leaving argp->acl_access dangling. The fix involves adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl() to release both argp->acl_access and argp->acl_default in addition to fh_put(), and wiring them as pc_release for their respective SETACL procedures.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Ensure that the Linux kernel is updated to the latest version
• Monitor the system for any suspicious activity related to nfsd
• Verify system configurations for exposure
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was resolved by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl() to release posix_acl on decode failure. This fix addresses the posix_acl leak issue in the Linux kernel's nfsd. Linux kernel users and administrators should verify their systems for exposure and apply patches or mitigations as needed. Evidence is based on the CVE record and NVD details.

Official resources