Linux Kernel NFSD SECINFO_NO_NAME Decoder Initialization Flaw

CVE-2026-53398 is a critical memory safety vulnerability in the Linux kernel's NFS server (NFSD) implementation affecting the SECINFO_NO_NAME operation decoder. The vulnerability stems from improper initialization sequencing in nfsd4_decode_secinfo_no_name(), where the sin_exp structure field is initialized after sin_style decoding. When an XDR stream is malformed or truncated, the decoder returns an error before sin_exp is initialized, leaving uninitialized kernel memory in the iops array. This affects all Linux systems running vulnerable kernel versions with NFSD enabled, particularly those providing NFS services in multi-tenant or untrusted network environments where attackers can send crafted NFS requests.

While CVE-2026-53398 does not yet map to specific MITRE ATT&CK techniques in the public framework, Casky practitioners would detect attack patterns through behavioral analysis of XDR processing anomalies and kernel memory state violations. Extended reasoning across Casky's 754 security skills would correlate this vulnerability with techniques under T1190 (Exploit Public-Facing Application) and T1499 (Endpoint Denial of Service), as successful exploitation could trigger kernel panics or enable information disclosure through uninitialized memory reads. Practitioners using Casky would observe findings related to RPC protocol anomalies, failed SECINFO operations with subsequent memory corruption signatures, and potential privilege escalation attempts leveraging the uninitialized state to escape NFSD sandboxing—critical indicators for NFSD-based attack chains in network reconnaissance and lateral movement scenarios.