PT-2026-61101 · Linux · Linux
CVE-2026-53396
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.1
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix acl leak and ignored error in nfsd4 create file
nfsd4 create file() has two bugs in its ACL handling:
The return value of nfsd4 acl to attr() is silently discarded. When
the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for
unsupported ACE types), the file is created without any ACL and the
client receives NFS4 OK. This violates RFC 7530/8881 which require
the server to reject unsupported attributes on CREATE.
When start creating() fails after ACL attributes have been populated
in attrs (either via nfsd4 acl to attr or via ownership transfer from
open->op dpacl/op pacl), the function jumps to out write which skips
nfsd attrs free(). The posix acl allocations are leaked. A client
can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an
invalid filename (e.g., longer than NAME MAX).
Fix both by capturing the nfsd4 acl to attr() return value and by
changing the early error paths to jump to out instead of out write.
Initialize child to ERR PTR(-EINVAL) so that end creating() is safe
to call even if start creating() was never reached.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux