CVE-2026-53398

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NFSD: Fix SECINFO_NO_NAME decode error cleanup<br /> <br /> nfsd4_decode_secinfo_no_name() currently initializes sin_exp after<br /> decoding sin_style. If the XDR stream is truncated, the decoder returns<br /> nfserr_bad_xdr before sin_exp is initialized.<br /> <br /> Since commit 3fdc54646234 ("NFSD: Reduce amount of struct<br /> nfsd4_compoundargs that needs clearing"), the inline iops array is not<br /> cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore<br /> leave sin_exp holding stale union contents from a previous operation.<br /> <br /> The error response path still invokes nfsd4_secinfo_no_name_release(),<br /> which calls exp_put() on a non-NULL sin_exp.<br /> <br /> Initialize sin_exp before the first failable decode step, matching<br /> nfsd4_decode_secinfo().