---
id: CVE-2026-53395
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix dead ACL conflict guard in nfsd4_create

  nfsd4_create() steals create->cr_dpacl/cr_pacl into the local
  nfsd_attrs via the designated initializer, then immedia…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix dead ACL conflict guard in nfsd4_create

  nfsd4_create() steals create->cr_dpacl/cr_pacl into the local
  nfsd_attrs via the designated initializer, then immedia…
severity: none
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53395'
references:
  - url: 'https://git.kernel.org/stable/c/8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a60f25a800846ab8e5a13f8a9d05111f2aee55a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-07-19T21:33:34.903Z'
epss: 0.00488
epssPercentile: 0.41104
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dead ACL conflict guard in nfsd4_create

nfsd4_create() steals create->cr_dpacl/cr_pacl into the local
nfsd_attrs via the designated initializer, then immediately sets the
source pointers to NULL. The subsequent conflict guard tests the
already-nilled source fields, making it permanently dead code:

    if (create->cr_acl) {
        if (create->cr_dpacl || create->cr_pacl)  /* always false */

When a client encodes both FATTR4_WORD0_ACL and
FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr
bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without
releasing the originals, leaking two posix_acl slab objects per
request. Repeated requests cause unbounded slab exhaustion.

Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of
the nilled create->cr_dpacl/cr_pacl, matching the correct pattern
already used in nfsd4_setattr().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.