CVE-2026-53398

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nfsd4 decode secinfo no name() function where sin exp is initialized after the sin style is decoded. If the XDR (External Data Representation) stream is truncated, the decoder returns nfserr bad xdr before sin exp is initialized. Because the inline iops array is not cleared between RPC calls, sin exp may retain stale data from a previous operation. Consequently, the error response path invokes nfsd4 secinfo no name release(), which then calls exp put() on a non-NULL sin exp containing invalid data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.