CVE-2026-53398

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53398", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.402Z", "datePublished": "2026-07-19T12:01:59.507Z", "dateUpdated": "2026-10-19T20:07:46.561Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:50:50.328Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in nfsd4_decode_secinfo_no_name() on the NFSv4 COMPOUND RPC decode path; nfsd is an in-kernel network file server reached remotely over TCP/UDP port 2049 by any client that can connect.\nAC:L - An attacker on the same TCP connection can first send a valid SECINFO_NO_NAME compound to leave a dangling sin_exp in the reused iops[] slot, then send a truncated SECINFO_NO_NAME to trigger nfserr_bad_xdr and nfsd4_secinfo_no_name_release() without re-initializing sin_exp.\nPR:N - Exploitation requires only network reachability to nfsd and standard NFSv4.1 session setup (EXCHANGE_ID/CREATE_SESSION/SEQUENCE); default exports accept RPC_AUTH_NULL with no local privileges, matching an unauthenticated remote attacker on a misconfigured or internet-exposed NFS server.\nUI:N - No victim user action is required; the attacker triggers the bug entirely by sending crafted NFSv4 COMPOUND RPC requests to the server.\nS:U - Impact is confined to kernel nfsd/export-cache memory mismanagement on the NFS server; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The stale sin_exp causes exp_put()/cache_put() on an uninitialized or already-freed svc_export pointer, corrupting export-cache refcounts and creating a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Incorrect kref_put() on a dangling or garbage svc_export pointer is exploitable memory corruption that can lead to further heap manipulation and potential arbitrary kernel code execution, not merely a bounded error.\nA:H - Calling exp_put() on an invalid pointer reliably causes kernel oops/panic or premature export-cache destruction, producing high availability impact including NFS service disruption and possible full kernel crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4xdr.c"], "versions": [{"version": "5e76b25d7cc82c148d391c0c43b884e6427cb302", "lessThan": "8836405abdc53ca3dd5fc68b2cf6f8f012fad011", "status": "affected", "versionType": "git"}, {"version": "07b68ff5c71cf4ed5443016d8eb116863c0a4d88", "lessThan": "49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "5ec37edcb534f3fc92304be236d37f08e6545585", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "1e04be34cafae119e82bcaccd6d28a20f72a3647", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "161d1aaeb04d620d3692639700512bb5038c1e10", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "c8a24effd96d4779e2ad779654682304491c55a5", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "46eb17d45be69d28c7a23ea03283b207426a8232", "status": "affected", "versionType": "git"}, {"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "9e18e83b8846a5c3fe13fc8a464b4865d33996c6", "status": "affected", "versionType": "git"}, {"version": "5.10.220", "lessThan": "5.10.260", "status": "affected", "versionType": "semver"}, {"version": "5.15.154", "lessThan": "5.15.211", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4xdr.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.260", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.211", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.220", "versionEndExcluding": "5.10.260"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.154", "versionEndExcluding": "5.15.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011"}, {"url": "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439"}, {"url": "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585"}, {"url": "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647"}, {"url": "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10"}, {"url": "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5"}, {"url": "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232"}, {"url": "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6"}], "title": "NFSD: Fix SECINFO_NO_NAME decode error cleanup", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53398", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:30:25.764915Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-665", "description": "CWE-665 Improper Initialization"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:07:46.561Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53398", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:30:25.764915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:30:26.318Z"}}], "cna": {"title": "NFSD: Fix SECINFO_NO_NAME decode error cleanup", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in nfsd4_decode_secinfo_no_name() on the NFSv4 COMPOUND RPC decode path; nfsd is an in-kernel network file server reached remotely over TCP/UDP port 2049 by any client that can connect.\nAC:L - An attacker on the same TCP connection can first send a valid SECINFO_NO_NAME compound to leave a dangling sin_exp in the reused iops[] slot, then send a truncated SECINFO_NO_NAME to trigger nfserr_bad_xdr and nfsd4_secinfo_no_name_release() without re-initializing sin_exp.\nPR:N - Exploitation requires only network reachability to nfsd and standard NFSv4.1 session setup (EXCHANGE_ID/CREATE_SESSION/SEQUENCE); default exports accept RPC_AUTH_NULL with no local privileges, matching an unauthenticated remote attacker on a misconfigured or internet-exposed NFS server.\nUI:N - No victim user action is required; the attacker triggers the bug entirely by sending crafted NFSv4 COMPOUND RPC requests to the server.\nS:U - Impact is confined to kernel nfsd/export-cache memory mismanagement on the NFS server; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The stale sin_exp causes exp_put()/cache_put() on an uninitialized or already-freed svc_export pointer, corrupting export-cache refcounts and creating a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Incorrect kref_put() on a dangling or garbage svc_export pointer is exploitable memory corruption that can lead to further heap manipulation and potential arbitrary kernel code execution, not merely a bounded error.\nA:H - Calling exp_put() on an invalid pointer reliably causes kernel oops/panic or premature export-cache destruction, producing high availability impact including NFS service disruption and possible full kernel crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5e76b25d7cc82c148d391c0c43b884e6427cb302", "lessThan": "8836405abdc53ca3dd5fc68b2cf6f8f012fad011", "versionType": "git"}, {"status": "affected", "version": "07b68ff5c71cf4ed5443016d8eb116863c0a4d88", "lessThan": "49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "5ec37edcb534f3fc92304be236d37f08e6545585", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "1e04be34cafae119e82bcaccd6d28a20f72a3647", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "161d1aaeb04d620d3692639700512bb5038c1e10", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "c8a24effd96d4779e2ad779654682304491c55a5", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "46eb17d45be69d28c7a23ea03283b207426a8232", "versionType": "git"}, {"status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "lessThan": "9e18e83b8846a5c3fe13fc8a464b4865d33996c6", "versionType": "git"}, {"status": "affected", "version": "5.10.220", "lessThan": "5.10.260", "versionType": "semver"}, {"status": "affected", "version": "5.15.154", "lessThan": "5.15.211", "versionType": "semver"}], "programFiles": ["fs/nfsd/nfs4xdr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.260", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.211", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.177", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.38", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.3", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/nfs4xdr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011"}, {"url": "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439"}, {"url": "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585"}, {"url": "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647"}, {"url": "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10"}, {"url": "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5"}, {"url": "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232"}, {"url": "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.260", "versionStartIncluding": "5.10.220"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.211", "versionStartIncluding": "5.15.154"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.177", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:50:50.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53398", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:07:46.561Z", "dateReserved": "2026-06-09T07:44:35.402Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T12:01:59.507Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8836405abdc53ca3dd5fc68b2cf6f8f012fad011", "status": "affected", "version": "5e76b25d7cc82c148d391c0c43b884e6427cb302", "versionType": "git"}, {"lessThan": "49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439", "status": "affected", "version": "07b68ff5c71cf4ed5443016d8eb116863c0a4d88", "versionType": "git"}, {"lessThan": "5ec37edcb534f3fc92304be236d37f08e6545585", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "1e04be34cafae119e82bcaccd6d28a20f72a3647", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "161d1aaeb04d620d3692639700512bb5038c1e10", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "c8a24effd96d4779e2ad779654682304491c55a5", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "46eb17d45be69d28c7a23ea03283b207426a8232", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "9e18e83b8846a5c3fe13fc8a464b4865d33996c6", "status": "affected", "version": "3fdc546462348b8a497c72bc894e0cde9f10fc40", "versionType": "git"}, {"lessThan": "5.10.260", "status": "affected", "version": "5.10.220", "versionType": "semver"}, {"lessThan": "5.15.211", "status": "affected", "version": "5.15.154", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.260", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.211", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC66BC4A-1CF7-4DF3-88F5-9F3A16336769", "versionEndExcluding": "5.10.260", "versionStartIncluding": "5.10.220", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3978EB0-5691-4D70-AE21-624E11923A8B", "versionEndExcluding": "5.15.211", "versionStartIncluding": "5.15.154", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B153242-AC4E-4978-A3B6-5A63C1297CC1", "versionEndExcluding": "6.1.177", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E", "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo()."}], "id": "CVE-2026-53398", "lastModified": "2026-10-19T20:19:18.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53398", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:30:25.764915Z", "version": "2.0.3"}}]}, "published": "2026-07-19T12:16:50.933", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-665"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup", "id": "2502222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502222"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo().", "A flaw was found in the Linux kernel's Network File System Daemon (NFSD). The nfsd4_decode_secinfo_no_name() function does not properly initialize a pointer (sin_exp) before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from previous operations. This can lead to an improper cleanup operation, potentially causing system instability or a denial of service."], "name": "CVE-2026-53398", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53398\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53398\nhttps://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e76b25d7cc82c148d391c0c43b884e6427cb302,8836405abdc53ca3dd5fc68b2cf6f8f012fad011)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b68ff5c71cf4ed5443016d8eb116863c0a4d88,49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,5ec37edcb534f3fc92304be236d37f08e6545585)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,1e04be34cafae119e82bcaccd6d28a20f72a3647)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,161d1aaeb04d620d3692639700512bb5038c1e10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,c8a24effd96d4779e2ad779654682304491c55a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,46eb17d45be69d28c7a23ea03283b207426a8232)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fdc546462348b8a497c72bc894e0cde9f10fc40,9e18e83b8846a5c3fe13fc8a464b4865d33996c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.220,5.10.260)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.154,5.15.211)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.260,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.211,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T01:30:17.675956+00:00", "updated": "2026-10-20T14:15:14.440047+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665"]}