CVE-2026-53026

NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

High · published June 24, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already

set by another thread, __nfs4_file_get_access should not be called

to increment the nfs4_file access count since that was already done

by the thread that added READ access to the file. The extra fi_access

count in nfs4_file can prevent the corresponding nfsd_file from being

freed.

When stopping nfs-server service, these extra access counts trigger a

BUG in kmem_cache_destroy() that shows nfsd_file object remaining on

__kmem_cache_shutdown.

This problem can be reproduced by running the Git project's test

suite over NFS.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00426 · 35.8th percentile
Published
2026-06-24T16:29Z
EPSS history
Timeline
  • 24 JUN 16:29Z
    NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
    cvelistv5