In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53395 is a logic error in the Linux kernel's nfsd4_create() function where ACL (Access Control List) conflict validation code becomes unreachable due to premature pointer nullification. The vulnerability exists in the Network File System Daemon (nfsd) component, which handles NFS protocol operations on Linux servers. When a client sends a CREATE request with ACL parameters, the function transfers ACL pointers into local variables and immediately nulls the source fields, causing subsequent validation checks to always fail silently. This affects any Linux system running nfsd that processes NFS requests, particularly those supporting NFSv4 with ACL extensions. The dead code prevents proper conflict detection when both default and non-default ACLs are specified, potentially allowing invalid or conflicting ACL configurations to bypass security checks.
While Casky currently shows 0 matching skills for this specific CVE, the underlying vulnerability pattern relates to improper input validation and access control enforcement—areas covered by MITRE ATT&CK techniques like T1548 (Abuse Elevation Control Mechanism) and T1222 (File and Directory Permissions Modification). Security practitioners using Casky's Claude AI-powered analysis would identify similar issues by examining kernel source code for: (1) logic flow anomalies where validation guards reference nullified variables, (2) ACL permission boundary violations in file system operations, and (3) race conditions between resource initialization and security policy enforcement. When investigating nfsd-related security findings, practitioners should look for patterns where access control parameters are moved but validation still references original locations—a common anti-pattern that extended reasoning can surface across similar codebases.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53395. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation