CVE-2026-53397

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFACL. Each successful call transfers ownership of a freshly allocated posix_acl into argp->acl_access or argp->acl_default. If the first call succeeds but the second fails, the decoder returns false and argp->acl_access is left dangling. ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and ACLPROC3_SETACL.pc_release was wir...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < b2eb1ffd511d1b3c3e21122f97cbbccea411e277, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < b94c4be77682aab06d65ca7296149e3bcfb37353, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 887f92ceccf3eacd5f2402db21254d66372fae00, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 1e96239fddcefacf6afe6c498357be68eacbcabc, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < bd69a825485168ef74e815ecb286754b570fdcc7, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 136b416593f1349cf6f72c8e3d18f0f204ee8545, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < a5b42c1e4ff2befaa6b96f7cbf32174751eba083, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 0853ac544c590880d797b04daa33fcb72b6be0e1, >= 2.6.13, >= 2.6.13 < 5.10.260, >= 5.11 < 5.15.211, >= 5.16 < 6.1.177, >= 6.2 < 6.6.144, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3

Fixed versions

5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-401