PT-2026-61103 · Linux · Linux

CVE-2026-53398 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix SECINFO NO NAME decode error cleanup

nfsd4 decode secinfo no name() currently initializes sin exp after decoding sin style. If the XDR stream is truncated, the decoder returns nfserr bad xdr before sin exp is initialized.

Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4 compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO NO NAME decode can therefore leave sin exp holding stale union contents from a previous operation.

The error response path still invokes nfsd4 secinfo no name release(), which calls exp put() on a non-NULL sin exp.

Initialize sin exp before the first failable decode step, matching nfsd4 decode secinfo().

Correção

Identificadores relacionados

CVE-2026-53398

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232 · Nota
• https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 · Nota
• https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53398 · Nota de Segurança
• https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10 · Nota
• https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647 · Nota
• https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5 · Nota
• https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585 · Nota
• https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6 · Nota