In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Control then falls through past the `if (oo)` guard -- which would have freed any pre-allocated `new` -- and unconditionally executes `new = alloc_stateowner(...)`. If `new` was already allocated on a prior iteration, the pointer is silently overwritten and the previous allocation (slab object + owner name buffer) is leaked. This requires a race: two NFSv4.0 OPEN threads with the same owner string, where a concurrent thread inserts a new unconfirmed owner into the hash between retry iterations. The window is narrow but repeatable under adversarial conditions. Fix by adding `goto retry` after `oo = NULL` so the already-allocated `new` is reused on the next iteration rather than overwritten.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53394 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) implementation, specifically in the open state owner allocation logic. When the find_or_alloc_open_stateowner() function encounters an unconfirmed owner during a retry race condition, it releases the owner but fails to free a previously allocated stateowner structure before allocating a new one. This results in a classic use-after-free and memory leak scenario that could lead to denial of service through memory exhaustion. Linux systems running NFS server functionality are affected, particularly those handling concurrent client connection attempts with timing-sensitive race conditions. While not actively exploited according to CISA KEV, the vulnerability poses a risk to availability in multi-tenant environments where attackers could trigger repeated unconfirmed retry races to gradually exhaust kernel memory.
Although this specific CVE does not map to MITRE ATT&CK techniques in the current framework, Casky's security skills would detect the underlying attack pattern through behavioral analysis of kernel memory allocation anomalies. Practitioners using Casky would observe findings related to resource exhaustion patterns, specifically monitoring for: (1) abnormal kernel memory growth patterns associated with nfsd processes, (2) repeated NFS connection state transitions that correlate with allocation-deallocation mismatches, and (3) system-level indicators of denial of service attempts targeting the NFS daemon. The platform's extended reasoning capabilities would correlate these low-level kernel behaviors with potential T1499 (Endpoint Denial of Service) attack patterns, helping security teams identify when attackers are systematically exploiting this race condition to degrade system performance.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53394. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation