Skip to main content

Linux Kernel CVE-2026-53394

| EUVDEUVD-2026-45516 HIGH
Memory Leak (CWE-401)
2026-07-19 Linux GHSA-3gwr-8cwh-87h2
Information Disclosure Linux
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.7 LOW

Network-reachable nfsd with no auth (PR:N), but exploitation hinges on winning a narrow race (AC:H) and each success leaks only a small allocation, yielding gradual availability impact (A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:23 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:01 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race

When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Control then falls through past the if (oo) guard -- which would have freed any pre-allocated new -- and unconditionally executes new = alloc_stateowner(...). If new was already allocated on a prior iteration, the pointer is silently overwritten and the previous allocation (slab object + owner name buffer) is leaked.

This requires a race: two NFSv4.0 OPEN threads with the same owner string, where a concurrent thread inserts a new unconfirmed owner into the hash between retry iterations. The window is narrow but repeatable under adversarial conditions.

Fix by adding goto retry after oo = NULL so the already-allocated new is reused on the next iteration rather than overwritten.

AnalysisAI

Memory exhaustion in the Linux kernel NFS server (nfsd) arises from a leak of a pre-allocated openowner structure in find_or_alloc_open_stateowner() when handling NFSv4.0 OPEN retries. When an unconfirmed owner is encountered, release_openowner() runs and control falls through the if (oo) cleanup guard, so a previously allocated new state-owner (slab object plus owner-name buffer) is silently overwritten and leaked. Remote clients that can reach the NFS service can, under a specific race, repeatedly trigger this leak to degrade or exhaust server memory. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; impact is availability-only (no data disclosure despite the mislabeled tag).

Technical ContextAI

The flaw lives in the kernel NFSv4 server (fs/nfsd) state-owner management. NFSv4.0 tracks OPEN operations via 'openowner' structures keyed by a client-supplied owner string; find_or_alloc_open_stateowner() looks up an existing owner or allocates a new one with alloc_stateowner(). The bug is a resource/memory leak (CWE-401, Missing Release of Memory After Effective Lifetime - the input lists CWE as N/A) in the retry path: after calling release_openowner() on an unconfirmed owner and setting oo = NULL, execution bypasses the if (oo) branch that would have freed a previously allocated new, then unconditionally re-runs alloc_stateowner(), overwriting and orphaning the prior allocation. The leaked objects are unreclaimable kernel slab allocations plus the associated owner-name buffer. The upstream fix adds goto retry after oo = NULL so the already-allocated new is reused instead of overwritten. Affected products per CPE are the mainline Linux kernel (cpe:2.3:a:linux:linux) with the NFS server (nfsd) module in use.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 6.12.95, 7.1.3, or 6.18.38 (or later within your series), which incorporate the goto retry fix. Apply the stable-tree commits from git.kernel.org (c9aefb2b5f11, 017a6150106b, a10bf67fe064, 57aee7a35bb1) if you build custom kernels, and consult your distribution's backported advisory for the exact packaged version. If patching must be deferred, the effective compensating control is to restrict who can reach the NFS server: firewall NFSv4 (TCP/2049) so only trusted, authenticated client subnets can connect, which shrinks the pool of actors able to attempt the race but breaks access for any legitimate client you fail to allowlist. Where feasible, temporarily disabling or unexporting the nfsd service on hosts that do not require it removes exposure entirely at the cost of NFS availability. Monitor kernel slab usage (e.g., nfsd4_stateowners in /proc/slabinfo) to detect leak-driven growth as an interim detective control.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53394 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy