---
id: CVE-2026-53398
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Fix SECINFO_NO_NAME decode error cleanup

  nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
  decoding sin_style
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Fix SECINFO_NO_NAME decode error cleanup

  nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
  decoding sin_style. If the XDR stream is truncated, t…
severity: critical
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53398'
references:
  - url: 'https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53398.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-53398'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502222'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53398'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53398'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:77690'
  - url: 'https://access.redhat.com/errata/RHSA-2026:77689'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
ingestedAt: '2026-07-19T22:33:55.349Z'
epss: 0.00543
epssPercentile: 0.45399
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e76b25d7cc82c148d391c0c43b884e6427cb302 <
    8836405abdc53ca3dd5fc68b2cf6f8f012fad011
  - >-
    Linux >= 07b68ff5c71cf4ed5443016d8eb116863c0a4d88 <
    49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    5ec37edcb534f3fc92304be236d37f08e6545585
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    1e04be34cafae119e82bcaccd6d28a20f72a3647
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    161d1aaeb04d620d3692639700512bb5038c1e10
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    c8a24effd96d4779e2ad779654682304491c55a5
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    46eb17d45be69d28c7a23ea03283b207426a8232
  - >-
    Linux >= 3fdc546462348b8a497c72bc894e0cde9f10fc40 <
    9e18e83b8846a5c3fe13fc8a464b4865d33996c6
  - Linux >= 5.10.220 < 5.10.260
  - Linux >= 5.15.154 < 5.15.211
  - Linux 6.1
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:30:25.764915Z'
cvssSource: cna
patched:
  - 10base_smtv
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_hidden_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_10
  - enterprise_linux_real_time_v_9
cwe:
  - CWE-824
scores:
  cna: 9.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix SECINFO_NO_NAME decode error cleanup

nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
decoding sin_style. If the XDR stream is truncated, the decoder returns
nfserr_bad_xdr before sin_exp is initialized.

Since commit 3fdc54646234 ("NFSD: Reduce amount of struct
nfsd4_compoundargs that needs clearing"), the inline iops array is not
cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore
leave sin_exp holding stale union contents from a previous operation.

The error response path still invokes nfsd4_secinfo_no_name_release(),
which calls exp_put() on a non-NULL sin_exp.

Initialize sin_exp before the first failable decode step, matching
nfsd4_decode_secinfo().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:77690** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77690)
- **RHSA-2026:77689** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77689)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53398.json)