CVE-2026-53395

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: fix dead ACL conflict guard in nfsd4_create<br /> <br /> nfsd4_create() steals create-&gt;cr_dpacl/cr_pacl into the local<br /> nfsd_attrs via the designated initializer, then immediately sets the<br /> source pointers to NULL. The subsequent conflict guard tests the<br /> already-nilled source fields, making it permanently dead code:<br /> <br /> if (create-&gt;cr_acl) {<br /> if (create-&gt;cr_dpacl || create-&gt;cr_pacl) /* always false */<br /> <br /> When a client encodes both FATTR4_WORD0_ACL and<br /> FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr<br /> bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without<br /> releasing the originals, leaking two posix_acl slab objects per<br /> request. Repeated requests cause unbounded slab exhaustion.<br /> <br /> Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of<br /> the nilled create-&gt;cr_dpacl/cr_pacl, matching the correct pattern<br /> already used in nfsd4_setattr().