CVE-2026-53398

NFSD: Fix SECINFO_NO_NAME decode error cleanup

State: Published
Severity: 9.8 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix SECINFO_NO_NAME decode error cleanup

nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized.

Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation.

The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp.

Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-665 Improper Initialization

Affected Products

Product	Versions
LinuxLinux	5e76b25d7cc82c148d391c0c43b884e6427cb302 to before 8836405abdc53ca3dd5fc68b2cf6f8f012fad011Affected 07b68ff5c71cf4ed5443016d8eb116863c0a4d88 to before 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 5ec37edcb534f3fc92304be236d37f08e6545585Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 1e04be34cafae119e82bcaccd6d28a20f72a3647Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 161d1aaeb04d620d3692639700512bb5038c1e10Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before c8a24effd96d4779e2ad779654682304491c55a5Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 46eb17d45be69d28c7a23ea03283b207426a8232Affected 3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 9e18e83b8846a5c3fe13fc8a464b4865d33996c6Affected 5.10.220 to before 5.10.260Affected 5.15.154 to before 5.15.211Affected
LinuxLinux	6.1Affected before 6.1Not affected 5.10.260 through 5.10.Not affected 5.15.211 through 5.15.Not affected 6.1.177 through 6.1.Not affected 6.6.144 through 6.6.Not affected 6.12.95 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5e76b25d7cc82c148d391c0c43b884e6427cb302 to before 8836405abdc53ca3dd5fc68b2cf6f8f012fad011Affected
07b68ff5c71cf4ed5443016d8eb116863c0a4d88 to before 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 5ec37edcb534f3fc92304be236d37f08e6545585Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 1e04be34cafae119e82bcaccd6d28a20f72a3647Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 161d1aaeb04d620d3692639700512bb5038c1e10Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before c8a24effd96d4779e2ad779654682304491c55a5Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 46eb17d45be69d28c7a23ea03283b207426a8232Affected
3fdc546462348b8a497c72bc894e0cde9f10fc40 to before 9e18e83b8846a5c3fe13fc8a464b4865d33996c6Affected
5.10.220 to before 5.10.260Affected
5.15.154 to before 5.15.211Affected

LinuxLinux

6.1Affected
before 6.1Not affected
5.10.260 through 5.10.*Not affected
5.15.211 through 5.15.*Not affected
6.1.177 through 6.1.*Not affected
6.6.144 through 6.6.*Not affected
6.12.95 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.