What is the CVSS score of CVE-2026-53395?

CVE-2026-53395 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-53395?

CVE-2026-53395 is a remote denial-of-service vulnerability in Linux kernel NFS servers (nfsd) that allows NFSv4 clients to exhaust kernel memory and render file services unavailable; no public…. A patch is available.

How to fix or mitigate CVE-2026-53395?

Within 24 hours: Identify all systems running Linux nfsd and determine their network exposure; if serving untrusted clients, apply temporary firewall restrictions on NFSv4 (TCP/UDP port 2049) until patched. Within 7 days: Apply the kernel patch from your Linux distributor for CVE-2026-53395 (version details available in vendor security advisory; verify against your distributor's NFS/kernel security bulletin). Within 30 days: Validate patched systems in staging environments, deploy to production during maintenance windows, and test NFS service recovery procedures to confirm business continuity plans remain effective.

Linux Kernel CVE-2026-53395

EUVD-2026-45517 HIGH

Uncontrolled Recursion (CWE-674)

2026-07-19 Linux

GHSA-hmpx-qpgp-fw83

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable NFS server with low complexity, but exploitation needs write-capable export access so PR:L; impact is availability-only slab exhaustion (C:N/I:N/A:H), no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:23 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 12:01 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dead ACL conflict guard in nfsd4_create

nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code:

if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */

When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion.

Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().

AnalysisAI

Remote denial of service in the Linux kernel NFS server (nfsd) allows an NFSv4 client to leak kernel memory by sending CREATE requests that encode both a native NFSv4 ACL (FATTR4_WORD0_ACL) and POSIX default/access ACLs (FATTR4_WORD2) in the same fattr bitmap. A dead conflict-guard in nfsd4_create() fails to release the original posix_acl objects when nfsd4_acl_to_attr() overwrites them, leaking two posix_acl slab objects per request; repeated requests drive unbounded slab exhaustion. There is no public exploit identified at time of analysis, this is not on CISA KEV, and the impact is availability only (CVSS 7.5, A:H) despite the input tag labelling it 'Information Disclosure'.

Technical ContextAI

The flaw lives in the kernel's NFSv4 server code path (fs/nfsd), specifically nfsd4_create(), which handles file/object creation carrying attribute (fattr) bitmaps. nfsd4_create() uses a designated initializer to 'steal' create->cr_dpacl and create->cr_pacl into a local nfsd_attrs structure and then nils the source pointers. The subsequent conflict guard if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) ... } tests the already-nilled source fields, so it is permanently dead code. When both an NFSv4 ACL and POSIX default/access ACLs are supplied together, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without freeing the originals, leaking posix_acl slab allocations. This is a memory-management / resource-leak class bug (CWE-401-style missing release of memory after effective lifetime; the input lists CWE as N/A). The correct pattern already exists in nfsd4_setattr(), which checks the stolen attrs.na_dpacl/na_pacl values; the fix ports that check into nfsd4_create(). CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, with the vulnerable subsystem being the in-kernel NFS server (nfsd) with POSIX ACL translation.

RemediationAI

Upstream fix available (PR/commit); the released patched version is best confirmed against your distribution rather than mainline. Apply the kernel update containing stable commits 8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e and a60f25a800846ab8e5a13f8a9d05111f2aee55a7 (EUVD indicates fixed lines including 7.1.3 and 7.2-rc1); track your vendor's backport rather than assuming a specific mainline tag. Primary action is to upgrade to your distribution's patched kernel and reboot, or apply the vendor's live-patch if offered. As compensating controls where patching must be deferred: restrict NFS export access to trusted client subnets via exports/firewall (allow only known NFSv4 clients to reach the server, blocking untrusted hosts from issuing CREATE operations) - trade-off is it does nothing against a compromised or malicious authorized client; if POSIX ACL translation is not required, disabling ACL support on the affected exports removes the vulnerable dual-ACL code path but breaks any workflow depending on POSIX/NFSv4 ACL interoperability; and monitor kernel slab usage (e.g. posix_acl_cache in /proc/slabinfo) to detect and alert on abnormal growth so the server can be restarted before exhaustion. Advisory/patch URLs: the two git.kernel.org commit links above and https://nvd.nist.gov/vuln/detail/CVE-2026-53395.

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

8.8

CVE-2019-9543 HIGH POC

8.8

CVE-2019-9144 HIGH POC

8.8

CVE-2019-9143 HIGH POC

8.8

CVE-2026-9769 HIGH POC

8.7

CVE-2026-40345 HIGH POC

8.2

CVE-2025-9624 HIGH POC

8.3

CVE-2019-9192 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-53395 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-53395

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-674 – Uncontrolled Recursion

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code