{"id":"CVE-2026-53398","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, t…","severity":"critical","published":"2026-07-19","updated":"2026-07-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53398","references":[{"url":"https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53398.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53398"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502222"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53398"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53398"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:77690"},{"url":"https://access.redhat.com/errata/RHSA-2026:77689"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"ingestedAt":"2026-07-19T22:33:55.349Z","epss":0.00543,"epssPercentile":0.45399,"vendor":"Linux","product":"Linux","affected":["Linux >= 5e76b25d7cc82c148d391c0c43b884e6427cb302 < 8836405abdc53ca3dd5fc68b2cf6f8f012fad011","Linux >= 07b68ff5c71cf4ed5443016d8eb116863c0a4d88 < 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < 5ec37edcb534f3fc92304be236d37f08e6545585","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < 1e04be34cafae119e82bcaccd6d28a20f72a3647","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < 161d1aaeb04d620d3692639700512bb5038c1e10","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < c8a24effd96d4779e2ad779654682304491c55a5","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < 46eb17d45be69d28c7a23ea03283b207426a8232","Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 < 9e18e83b8846a5c3fe13fc8a464b4865d33996c6","Linux >= 5.10.220 < 5.10.260","Linux >= 5.15.154 < 5.15.211","Linux 6.1"],"cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:30:25.764915Z"},"cvssSource":"cna","patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"cwe":["CWE-824"],"scores":{"cna":9.8,"vendor":7},"slug":"CVE-2026-53398","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:77690** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77690)\n- **RHSA-2026:77689** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77689)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53398.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223124,"id":"CVE-2026-53398","ts":1792172305372,"field":"cvss","old":null,"new":"9.8"},{"seq":223123,"id":"CVE-2026-53398","ts":1792172305372,"field":"severity","old":"none","new":"critical"}]}