CVE-2026-53395

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dead ACL conflict guard in nfsd4_create

nfsd4_create() steals create->cr_dpacl/cr_pacl into the local

nfsd_attrs via the designated initializer, then immediately sets the

source pointers to NULL. The subsequent conflict guard tests the

already-nilled source fields, making it permanently dead code:

if (create->cr_acl) {

if (create->cr_dpacl || create->cr_pacl) /* always false */

When a client encodes both FATTR4_WORD0_ACL and

FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr

bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without

releasing the originals, leaking two posix_acl slab objects per

request. Repeated requests cause unbounded slab exhaustion.

Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of

the nilled create->cr_dpacl/cr_pacl, matching the correct pattern

already used in nfsd4_setattr().