Skip to main content

Linux Kernel EUVDEUVD-2026-38894

| CVE-2026-53026 HIGH
2026-06-24 Linux GHSA-5968-j93g-c79f
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Reachable over the network via NFS but requires winning a non-deterministic refcount race (AC:H); no auth needed for client traffic (PR:N); availability-only impact (A:H), no C/I.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:53 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access should not be called to increment the nfs4_file access count since that was already done by the thread that added READ access to the file. The extra fi_access count in nfs4_file can prevent the corresponding nfsd_file from being freed.

When stopping nfs-server service, these extra access counts trigger a BUG in kmem_cache_destroy() that shows nfsd_file object remaining on __kmem_cache_shutdown.

This problem can be reproduced by running the Git project's test suite over NFS.

AnalysisAI

Denial of service in the Linux kernel's NFSD (in-kernel NFSv4 server) arises from an nfs4_file reference-count leak in nfsd4_add_rdaccess_to_wrdeleg, where __nfs4_file_get_access is wrongly called even when another thread has already taken READ access on the file. The leaked fi_access count keeps the backing nfsd_file pinned, so stopping the nfs-server service triggers a kernel BUG in kmem_cache_destroy() because nfsd_file objects remain on cache shutdown. The flaw affects systems running the in-kernel NFS server (fixed in 6.18.33, 7.0.10, and 7.1); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%).

Technical ContextAI

The defect lives in the kernel's NFSv4 server delegation handling. NFSv4 write delegations let a client be granted exclusive write access to a file; nfsd4_add_rdaccess_to_wrdeleg adds READ access (O_RDONLY) to an existing write-delegated nfs4_file so reads can be served locally. The nfs4_file structure tracks per-file open-mode access counts (fi_access) and caches backing nfsd_file handles in fi_fds[]. The bug is a concurrency/refcount error: when two threads race, the second calls __nfs4_file_get_access and increments the access count even though fp->fi_fds[O_RDONLY] was already populated by the first thread, double-counting the reference. Because nfsd_file objects are freed only when their access count drops to zero, the surplus count prevents teardown, and the slab allocator's __kmem_cache_shutdown integrity check fires a BUG when leftover objects remain in the nfsd_file kmem_cache. No CWE was assigned in the input, but the root cause is a reference-counting error in concurrent code (CWE-911 / CWE-362 class), leading to a resource leak rather than memory corruption.

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) - apply the stable fix corresponding to your kernel series; the upstream commits are at https://git.kernel.org/stable/c/4584229395d0d65bd517780afe97ffea07cb2c3d, https://git.kernel.org/stable/c/b81572b073441dfd32213e41857676d0dbff4665, and https://git.kernel.org/stable/c/b48f44f36e6607b2f818560f19deb86b4a9c717b. Because the bug only manifests through the in-kernel NFS server, the most effective compensating control until you can reboot into a patched kernel is to avoid exposing or relying on NFSD where not needed - disabling the nfs-server service removes the trigger entirely (trade-off: clients lose NFS exports). As a narrower workaround, disabling NFSv4 write delegations (e.g. setting the nfsd 'nfs4_disable_idmapping'/delegation tuning, or mounting/exporting without delegation support) avoids the nfsd4_add_rdaccess_to_wrdeleg path at the cost of reduced delegation performance/caching for clients. There is no data-loss risk from the leak itself, but plan a kernel update since the leak is cumulative and only cleared by reboot.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38894 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy