Linux Kernel NFSD POSIX ACL Memory Leak on Decode Failure

CVE-2026-53397 is a memory leak vulnerability in the Linux kernel's NFS server (nfsd) implementation that occurs during the decoding of SETACL requests. When nfsaclsvc_decode_setaclargs() or nfs3svc_decode_setaclargs() processes ACL data, it makes two separate calls to nfs_stream_decode_acl()—one for NFS_ACL and one for NFS_DFACL. If the first call succeeds and allocates a posix_acl structure, but the second call fails, the decoder returns false without properly freeing the first allocation, leaving a dangling pointer in argp->acl_access. This vulnerability affects Linux systems running NFS server functionality, particularly those exposed to network-accessible NFS services. While the CVSS score of 7.5 indicates high severity, the practical impact depends on attack surface exposure and the frequency with which an attacker can trigger decode failures.

Casky's extended reasoning capabilities would detect the attack patterns behind this vulnerability by analyzing memory management flows and resource allocation chains in kernel code. Practitioners using Casky would identify this through detection of anomalous resource exhaustion patterns—specifically, repeated NFS SETACL requests that trigger decode failures, progressively consuming kernel memory without corresponding cleanup. The security skills mapped to MITRE ATT&CK would correlate this with T1499 (Endpoint Denial of Service) patterns, as an attacker could exploit this leak to exhaust available kernel memory and degrade or crash the NFS service. A practitioner's findings would highlight suspicious sequences of malformed SETACL protocol messages from specific source IPs, coupled with system memory growth that correlates with NFS service activity, indicating potential exploitation attempts.