9.8
CRITICAL
CVSS 3.1
CVE-2026-53398
NFSD: Fix SECINFO_NO_NAME decode error cleanup
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().
Details
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Initialize sin_exp before decode steps to prevent stale union contents on error.
- Initialize sin_exp before failable decode steps.
- Ensure sin_exp is properly cleared between RPC calls.
- Apply the provided patch to the Linux kernel.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53398.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53398 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53398
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53398 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53398 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e76b25d7cc82c148d391c0c43b884e6427cb302', 'lessThan': '8836405abdc53ca3dd5fc68b2cf6f8f012fad011', 'versionType': 'git'}, {'status': 'affected', 'version': '07b68ff5c71cf4ed5443016d8eb116863c0a4d88', 'lessThan': '49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '5ec37edcb534f3fc92304be236d37f08e6545585', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '1e04be34cafae119e82bcaccd6d28a20f72a3647', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '161d1aaeb04d620d3692639700512bb5038c1e10', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': 'c8a24effd96d4779e2ad779654682304491c55a5', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '46eb17d45be69d28c7a23ea03283b207426a8232', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '9e18e83b8846a5c3fe13fc8a464b4865d33996c6', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.260', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.154', 'lessThan': '5.15.211', 'versionType': 'semver'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e76b25d7cc82c148d391c0c43b884e6427cb302', 'lessThan': '8836405abdc53ca3dd5fc68b2cf6f8f012fad011', 'versionType': 'git'}, {'status': 'affected', 'version': '07b68ff5c71cf4ed5443016d8eb116863c0a4d88', 'lessThan': '49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '5ec37edcb534f3fc92304be236d37f08e6545585', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '1e04be34cafae119e82bcaccd6d28a20f72a3647', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '161d1aaeb04d620d3692639700512bb5038c1e10', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': 'c8a24effd96d4779e2ad779654682304491c55a5', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '46eb17d45be69d28c7a23ea03283b207426a8232', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '9e18e83b8846a5c3fe13fc8a464b4865d33996c6', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.260', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.154', 'lessThan': '5.15.211', 'versionType': 'semver'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 29, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.38 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.1.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.220 up to (excluding) 5.10.260 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.154 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1 up to (excluding) 6.1.177 Added Reference Type kernel.org: https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5e76b25d7cc82c148d391c0c43b884e6427cb302', 'lessThan': '8836405abdc53ca3dd5fc68b2cf6f8f012fad011', 'versionType': 'git'}, {'status': 'affected', 'version': '07b68ff5c71cf4ed5443016d8eb116863c0a4d88', 'lessThan': '49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '5ec37edcb534f3fc92304be236d37f08e6545585', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '1e04be34cafae119e82bcaccd6d28a20f72a3647', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '161d1aaeb04d620d3692639700512bb5038c1e10', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': 'c8a24effd96d4779e2ad779654682304491c55a5', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '46eb17d45be69d28c7a23ea03283b207426a8232', 'versionType': 'git'}, {'status': 'affected', 'version': '3fdc546462348b8a497c72bc894e0cde9f10fc40', 'lessThan': '9e18e83b8846a5c3fe13fc8a464b4865d33996c6', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.220', 'lessThan': '5.10.260', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.154', 'lessThan': '5.15.211', 'versionType': 'semver'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/nfsd/nfs4xdr.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo(). Added Reference https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10 Added Reference https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647 Added Reference https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232 Added Reference https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 Added Reference https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585 Added Reference https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011 Added Reference https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6 Added Reference https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.