{"id":"CVE-2026-53394","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: avoid leaking pre-allocated openowner on unconfirmed retry race\n\nWhen find_or_alloc_open_stateowner() encounters an unconfirmed owner, it\ncalls release_openowner(…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: avoid leaking pre-allocated openowner on unconfirmed retry race\n\nWhen find_or_alloc_open_stateowner() encounters an unconfirmed owner, it\ncalls release_openowner(…","severity":"none","published":"2026-07-19","updated":"2026-07-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53394","references":[{"url":"https://git.kernel.org/stable/c/017a6150106b054cc84d1b0582d97bd3a74d4281","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57aee7a35bb12753057c5b65d72d1f46c0e95b07","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a10bf67fe06469a71a401f72f328237345d553c0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9aefb2b5f11337c9202c5bd0c45d71198449718","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"ingestedAt":"2026-07-19T21:33:34.881Z","epss":0.00483,"epssPercentile":0.4079,"slug":"CVE-2026-53394","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: avoid leaking pre-allocated openowner on unconfirmed retry race\n\nWhen find_or_alloc_open_stateowner() encounters an unconfirmed owner, it\ncalls release_openowner() and sets oo = NULL. Control then falls through\npast the `if (oo)` guard -- which would have freed any pre-allocated\n`new` -- and unconditionally executes `new = alloc_stateowner(...)`. If\n`new` was already allocated on a prior iteration, the pointer is\nsilently overwritten and the previous allocation (slab object + owner\nname buffer) is leaked.\n\nThis requires a race: two NFSv4.0 OPEN threads with the same owner\nstring, where a concurrent thread inserts a new unconfirmed owner into\nthe hash between retry iterations. The window is narrow but repeatable\nunder adversarial conditions.\n\nFix by adding `goto retry` after `oo = NULL` so the already-allocated\n`new` is reused on the next iteration rather than overwritten.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}