CVE-2026-53396

A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) within the nfsd4_create_file() function. This vulnerability allows a remote attacker to cause a denial of service (DoS) by repeatedly triggering a memory leak of posix_acl allocations. The leak occurs when a client attempts to create a file with Access Control List (ACL) attributes and an invalid filename, leading to resource exhaustion. Additionally, the flaw can result in files being created without the intended ACLs if the NFSv4-to-POSIX ACL conversion fails, potentially leading to unintended access permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.