{"id":14865,"date":"2026-09-04T19:02:15","date_gmt":"2026-09-04T11:02:15","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53397"},"modified":"2026-09-04T19:02:15","modified_gmt":"2026-09-04T11:02:15","slug":"cve-2026-53397","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53397","title":{"rendered":"CVE-2026-53397 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl l"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: fix posix_acl leak on SETACL decode failure<\/p>\n<p>nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each<br \/>\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for<br \/>\nNFS_DFACL.  Each successful call transfers ownership of a freshly<br \/>\nallocated posix_acl into argp-&gt;acl_access or argp-&gt;acl_default.  If<br \/>\nthe first call succeeds but the second fails, the decoder returns<br \/>\nfalse and argp-&gt;acl_access is left dangling.<\/p>\n<p>ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and<br \/>\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.<br \/>\nBoth only call fh_put() and have no knowledge of the ACL fields on<br \/>\nargp.  The posix_acl_release() pairs sat at the out: labels inside<br \/>\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()<br \/>\nskips pc_func when pc_decode returns false, so that cleanup is<br \/>\nunreachable on decode failure:<\/p>\n<p>    svc_process_common()<br \/>\n      pc_decode()                  \/* decode_setaclargs: false *\/<br \/>\n      \/* pc_func skipped *\/<br \/>\n      pc_release()                 \/* fh_put only &#8212; ACLs leaked *\/<\/p>\n<p>The orphaned posix_acl is leaked for the lifetime of the server.<\/p>\n<p>Fix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),<br \/>\nwhich release both argp-&gt;acl_access and argp-&gt;acl_default in addition<br \/>\nto fh_put(), and wiring them as pc_release for their respective SETACL<br \/>\nprocedures.  pc_release runs on every path svc_process() takes after<br \/>\ndecode, including decode failure, so the posix_acl_release() pairs are<br \/>\nremoved from the proc functions&#8217; out: labels to keep ownership in one<br \/>\nplace.  This matches the existing release_getacl() pattern used by<br \/>\nthe sibling GETACL procedures.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: fix posix_acl leak on SETACL decode failure<\/p>\n<p>nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each<br \/>\ncall nfs_stre<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14865","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}