CVE-2026-53394
kernel: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 19, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Network File System (NFS) version 4.0 (NFSv4.0) OPEN implementation. A race condition can occur when two NFSv4.0 OPEN threads with the same owner string attempt to open a file, and a concurrent thread inserts a new unconfirmed owner. This can lead to a memory leak where pre-allocated memory for an openowner is not properly released, potentially causing a Denial of Service (DoS) over time due to resource exhaustion.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime