CVE-2026-53394: In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unco
Summary
A memory leak vulnerability exists in the Linux kernel's NFSv4.0 (a network file sharing protocol) implementation where pre-allocated memory is not properly freed when certain race conditions occur (situations where two processes compete for the same resource at the same time). The bug happens when multiple concurrent OPEN requests with the same owner name are processed, and one thread encounters an unconfirmed owner while another thread is simultaneously modifying the shared data structure, causing the kernel to overwrite a pointer to previously allocated memory without freeing it first.
Solution / Mitigation
Fix by adding `goto retry` after `oo = NULL` so the already-allocated `new` is reused on the next iteration rather than overwritten.
Vulnerability Details
EPSS: 0.0%
July 19, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-53394
First tracked: July 19, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%