CVE-2026-53394

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race<br /> <br /> When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it<br /> calls release_openowner() and sets oo = NULL. Control then falls through<br /> past the `if (oo)` guard -- which would have freed any pre-allocated<br /> `new` -- and unconditionally executes `new = alloc_stateowner(...)`. If<br /> `new` was already allocated on a prior iteration, the pointer is<br /> silently overwritten and the previous allocation (slab object + owner<br /> name buffer) is leaked.<br /> <br /> This requires a race: two NFSv4.0 OPEN threads with the same owner<br /> string, where a concurrent thread inserts a new unconfirmed owner into<br /> the hash between retry iterations. The window is narrow but repeatable<br /> under adversarial conditions.<br /> <br /> Fix by adding `goto retry` after `oo = NULL` so the already-allocated<br /> `new` is reused on the next iteration rather than overwritten.