Skip to main content

Linux Kernel CVE-2026-53393

| EUVDEUVD-2026-45515 MEDIUM
2026-07-19 Linux GHSA-wm3m-j54f-523v
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.3 MEDIUM

AC:H because triggering requires a storage writeback error beyond attacker control; I:H added because clients receive a false durability signal misrepresenting data integrity state.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 29, 2026 - 22:51 vuln.today
CVSS changed
Jul 29, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:01 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nfsd: reset write verifier on deferred writeback errors

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable - silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.

AnalysisAI

Silent NFS data loss in the Linux kernel's nfsd subsystem allows UNSTABLE write data to be discarded without client notification when deferred writeback errors occur. Affected kernels prior to 6.12.95, 6.18.38, and 7.1.3 fail to rotate the server write verifier (nn->writeverf) in nfsd_vfs_write() and nfsd_commit() after filemap_check_wb_err() detects an error, so NFS clients receive an unchanged verifier on COMMIT and incorrectly conclude their data is durable - violating the UNSTABLE+COMMIT contract in RFC 1813 §3.3.7 and RFC 8881 §18.32. No public exploit exists and EPSS sits at 0.17% (6th percentile), placing this firmly in the operational-reliability rather than active-threat category.

Technical ContextAI

The Linux nfsd subsystem implements NFSv3 and NFSv4 server-side semantics, including the UNSTABLE write + COMMIT durability model. Under this model, clients batch writes with UNSTABLE semantics (data held in server cache, not yet on stable storage) and later issue a COMMIT to request a flush; the server responds with a write verifier that clients compare against the verifier seen during writes. If the verifier changes, the client knows storage state was disrupted and must resend data. The server must rotate nn->writeverf whenever a durable-storage failure is detected. The bug exists at two specific call sites - one in nfsd_vfs_write() and one in nfsd_commit() - where filemap_check_wb_err() returns an error but commit_reset_write_verifier() (which performs the rotation and already internally filters -EAGAIN and -ESTALE) is never called. Every adjacent error path in those same functions correctly calls the helper; these two filemap error sites were simply missed. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the Linux kernel broadly; the specific affected commit anchor is 555dbf1a9aac6d3150c8b52fa35f768a692f4eeb per EUVD-2026-45515. No CWE is assigned in the source data; the closest applicable class would be CWE-755 (Improper Handling of Exceptional Conditions) or CWE-390 (Detection of Error Condition Without Action).

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.12.95, 6.18.38, or 7.1.3, or to mainline 7.2-rc1. Upstream patch commits are available at the git.kernel.org stable repository links in the references (e.g., https://git.kernel.org/stable/c/1dd664b39774a9c89b72de8e59bf9ef4b3aaff2e and the other commits listed). For systems that cannot immediately patch, a targeted workaround is to configure NFS exports with the sync option (replacing async), which forces all writes to be committed to stable storage before the server responds, eliminating the UNSTABLE write code path entirely; the trade-off is a measurable reduction in NFS write throughput since the server can no longer batch and defer writes. A second mitigation is to stop the nfsd service entirely on any host not actively required to serve NFS clients, which eliminates exposure with no functional impact on non-NFS workloads. Consult https://nvd.nist.gov/vuln/detail/CVE-2026-53393 and https://seclists.org/oss-sec/2026/q3/230 for any additional vendor guidance.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-53393 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy