CVE-2026-53395

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the nfsd4 create() function when a client encodes both FATTR4 WORD0 ACL and FATTR4 WORD2 POSIX {DEFAULT,ACCESS} ACL in the same CREATE fattr bitmap. The function transfers create->cr dpacl and create->cr pacl into local nfsd attrs and sets the source pointers to NULL. Because the subsequent conflict guard checks the already-nilled source fields instead of the stolen values, the guard becomes dead code. Consequently, nfsd4 acl to attr() overwrites attrs.na pacl and attrs.na dpacl without releasing the original posix acl slab objects, leading to unbounded slab exhaustion through repeated requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.