In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives NFS4_OK. This violates RFC 7530/8881 which require the server to reject unsupported attributes on CREATE. When start_creating() fails after ACL attributes have been populated in attrs (either via nfsd4_acl_to_attr or via ownership transfer from open->op_dpacl/op_pacl), the function jumps to out_write which skips nfsd_attrs_free(). The posix_acl allocations are leaked. A client can trigger this repeatedly with OPEN(CREATE), ACL attributes, and an invalid filename (e.g., longer than NAME_MAX). Fix both by capturing the nfsd4_acl_to_attr() return value and by changing the early error paths
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53396 is a vulnerability in the Linux kernel's NFSv4 file creation handler that silently ignores ACL conversion errors, allowing files to be created without proper access controls. When nfsd4_create_file() attempts to convert NFSv4 ACLs to POSIX ACLs, it discards error returns from nfsd4_acl_to_attr(), meaning invalid or unsupported ACE types that should trigger rejection instead result in successful file creation with default permissions. This violates RFC 7530/8881 compliance requirements and affects any Linux system running vulnerable kernel versions that expose NFSv4 file services to clients. The impact is significant for shared storage environments, NAS appliances, and cloud infrastructure where NFSv4 is commonly deployed, as attackers could potentially bypass intended access control policies.
Detecting exploitation of this vulnerability requires monitoring for anomalous NFSv4 file creation patterns that deviate from expected ACL enforcement. Practitioners using Casky.ai would identify suspicious behaviors through T1222: File and Directory Permissions Modification detection patterns—specifically watching for files created via NFSv4 that lack expected ACLs or possess default permissions when clients explicitly requested restricted access controls. The platform's extended reasoning capabilities would correlate failed NFSv4 ACL conversion attempts with successful file creations, revealing the permission gap. Additionally, reconnaissance activities mapping file system permissions (T1526: Gather Victim Identity and Access Management Information) combined with subsequent file access attempts would indicate potential exploitation chains, allowing security teams to pinpoint vulnerable nfsd processes and affected file systems before unauthorized access occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53396. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation