CVE-2026-53398
A flaw in the Linux kernel’s NFS server can cause the server to crash when it receives a malformed request. The bug involves uninitialized memory that may be freed incorrectly, leading to a denial‑of‑service attack.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel NFS server (nfsd) on any system running a kernel version before the patch that fixes CVE‑2026‑53398. System administrators who expose NFS services are the typical users.
Real-world impact
An attacker who can send specially crafted NFS requests to the vulnerable server could force the server to crash, making the NFS share unavailable to legitimate users.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is network‑exposed, requires no special privileges or user interaction, and can completely compromise confidentiality, integrity, and availability of the NFS service.
What to do about it
- 011. Update the Linux kernel to a version that includes the fix for CVE‑2026‑53398 (the patch is part of the kernel commit 3fdc54646234).
- 022. Reboot the system or reload the kernel to activate the updated NFS server.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 29, 2026 · 16h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/161d1aaeb04d620d36…patch
- git.kernel.org/stable/c/1e04be34cafae119e8…patch
- git.kernel.org/stable/c/46eb17d45be69d28c7…patch
- git.kernel.org/stable/c/49de5d31dd8fdebf78…patch
- git.kernel.org/stable/c/5ec37edcb534f3fc92…patch
- git.kernel.org/stable/c/8836405abdc53ca3dd…patch
- git.kernel.org/stable/c/9e18e83b8846a5c3fe…patch
- git.kernel.org/stable/c/c8a24effd96d4779e2…patch