Linux Kernel EUVD-2026-45518

The vulnerability lives in the kernel NFS server (fs/nfsd), specifically the NFSv4 OPEN(CREATE) handling in nfsd4_create_file(). When a client requests file creation with NFSv4 ACL attributes, the server calls nfsd4_acl_to_attr() to translate the NFSv4 ACL model into the on-disk POSIX ACL model (posix_acl structures allocated in kernel memory). Two coding defects exist: (1) an ignored error return, an instance of CWE-252 (Unchecked Return Value) combined with CWE-703 (Improper Check or Handling of Exceptional Conditions), causing the server to proceed as if conversion succeeded and to accept the CREATE in violation of RFC 7530/8881 which require rejecting unsupported attributes; and (2) a control-flow error where the failure path jumps to out_write, bypassing nfsd_attrs_free(), which frees the op_dpacl/op_pacl posix_acl allocations - a classic CWE-401 (Missing Release of Memory After Effective Lifetime) kernel memory leak. The CPE data identifies the affected component as the mainline Linux kernel (cpe:2.3:a:linux:linux). The upstream fix captures the conversion return value, redirects early error paths to the 'out' label so attributes are freed, and initializes child to ERR_PTR(-EINVAL) so end_creating() is safe even when start_creating() was never reached.