PT-2026-61100 · Linux · Linux
CVE-2026-53395
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix dead ACL conflict guard in nfsd4 create
nfsd4 create() steals create->cr dpacl/cr pacl into the local
nfsd attrs via the designated initializer, then immediately sets the
source pointers to NULL. The subsequent conflict guard tests the
already-nilled source fields, making it permanently dead code:
if (create->cr acl) {
if (create->cr dpacl || create->cr pacl) /* always false */
When a client encodes both FATTR4 WORD0 ACL and
FATTR4 WORD2 POSIX {DEFAULT,ACCESS} ACL in the same CREATE fattr
bitmap, nfsd4 acl to attr() overwrites attrs.na pacl/na dpacl without
releasing the originals, leaking two posix acl slab objects per
request. Repeated requests cause unbounded slab exhaustion.
Fix by checking attrs.na dpacl/na pacl (the stolen values) instead of
the nilled create->cr dpacl/cr pacl, matching the correct pattern
already used in nfsd4 setattr().
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux