PT-2026-61102 · Linux · Linux

CVE-2026-53397 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix posix acl leak on SETACL decode failure

nfsaclsvc decode setaclargs() and nfs3svc decode setaclargs() each call nfs stream decode acl() twice, first for NFS ACL and then for NFS DFACL. Each successful call transfers ownership of a freshly allocated posix acl into argp->acl access or argp->acl default. If the first call succeeds but the second fails, the decoder returns false and argp->acl access is left dangling.

ACLPROC2 SETACL.pc release was wired to nfssvc release attrstat and ACLPROC3 SETACL.pc release was wired to nfs3svc release fhandle. Both only call fh put() and have no knowledge of the ACL fields on argp. The posix acl release() pairs sat at the out: labels inside nfsacld proc setacl() and nfsd3 proc setacl(), but svc process() skips pc func when pc decode returns false, so that cleanup is unreachable on decode failure:

svc process common() pc decode() /* decode setaclargs: false / / pc func skipped / pc release() / fh put only -- ACLs leaked */

The orphaned posix acl is leaked for the lifetime of the server.

Fix by adding nfsaclsvc release setacl() and nfs3svc release setacl(), which release both argp->acl access and argp->acl default in addition to fh put(), and wiring them as pc release for their respective SETACL procedures. pc release runs on every path svc process() takes after decode, including decode failure, so the posix acl release() pairs are removed from the proc functions' out: labels to keep ownership in one place. This matches the existing release getacl() pattern used by the sibling GETACL procedures.

Correção

Identificadores relacionados

CVE-2026-53397

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00 · Nota
• https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7 · Nota
• https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353 · Nota
• https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083 · Nota
• https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53397 · Nota de Segurança
• https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1 · Nota
• https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545 · Nota
• https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277 · Nota