CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-19
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Control then falls through past the `if (oo)` guard -- which would have freed any pre-allocated `new` -- and unconditionally executes `new = alloc_stateowner(...)`. If `new` was already allocated on a prior iteration, the pointer is silently overwritten and the previous allocation (slab object + owner name buffer) is leaked. This requires a race: two NFSv4.0 OPEN threads with the same owner string, where a concurrent thread inserts a new unconfirmed owner into the hash between retry iterations. The window is narrow but repeatable under adversarial conditions. Fix by adding `goto retry` after `oo = NULL` so the already-allocated `new` is reused on the next iteration rather than overwritten.

Affected products

Linux kernel: from 6.10 before 6.12.95; from 6.13 before 6.18.38; from 6.19 before 7.1.3 — fixed in 6.12.95, 6.18.38, 7.1.3

How to fix

Upgrade to a fixed version: Linux kernel 6.12.95, 6.18.38, 7.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53394 or the next vulnerability affects your stack