CVE-2026-53026: Linux NFSD Reference Counting Denial of Service

Technical summary

CVE-2026-53026 is a reference-counting bug in the NFSD subsystem's nfsd4_add_rdaccess_to_wrdeleg function. When a write delegation already exists on an nfs4_file and a second thread attempts to add read access, the code path checks whether fp->fi_fds[O_RDONLY] is already set. If it is, the function still calls __nfs4_file_get_access to increment the access count, even though the first thread that set the read FD already incremented the count. This double-increment leaves orphaned fi_access references that prevent the associated nfsd_file from being freed. At NFSD shutdown, kmem_cache_destroy detects objects still in the cache and triggers a BUG. The vulnerability manifests as a denial-of-service condition (crash) rather than data exposure or privilege escalation.

Business impact

Organizations running NFS-exported filesystems on Linux—particularly those serving Git repositories or similar workloads with concurrent reader/writer patterns—may experience unplanned service interruptions when stopping or restarting the NFS server. In production environments where NFS hosting is critical (development servers, shared storage, backup targets), this crash during shutdown can disrupt planned maintenance windows, delay failovers, and complicate cluster health management. The high CVSS score reflects the unavoidable denial of service, not remote code execution risk.

Affected systems

The vulnerability affects the Linux kernel's NFSD (NFS server daemon) subsystem across all versions that contain the vulnerable code path in nfsd4_add_rdaccess_to_wrdeleg. Systems running Linux as an NFS server are at risk; NFS clients are not affected. The bug is most readily triggered by workloads combining write delegations with concurrent read access patterns, such as the Git test suite, but can occur in any multi-threaded NFS access scenario.

Exploitability

This is not a remotely exploitable vulnerability in the traditional sense. There is no authentication bypass, privilege escalation, or code execution path. Exploitation requires only that the NFS service be running and that workloads generate the specific access pattern (concurrent read/write delegation transitions). Organizations using NFS are likely to encounter the trigger naturally; adversaries cannot weaponize this beyond forcing a denial-of-service shutdown through crafted NFS requests that provoke the race condition. The vulnerability is rated HIGH due to guaranteed service disruption, not attack surface.

Remediation

Apply a kernel update that includes the fix for nfsd4_add_rdaccess_to_wrdeleg. The patch adds a check to avoid calling __nfs4_file_get_access when fp->fi_fds[O_RDONLY] is already populated, ensuring only the first thread increments the access count. Verify against the Linux kernel security advisory or your distribution's patch notes for the specific kernel version addressing this issue.

Patch guidance

Identify your running Linux kernel version (uname -r) and consult your distribution's security advisory channels (Red Hat Security Advisories, Ubuntu Security Notices, etc.) for the corresponding patched kernel. Systems should be updated to the earliest stable kernel version from their branch that includes the nfsd4_add_rdaccess_to_wrdeleg fix. Test the patched kernel in a staging environment, particularly if you are running NFS-dependent services, before deploying to production. A reboot is required after kernel update.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for BUG messages mentioning kmem_cache_destroy or nfsd_file. If NFS service stops unexpectedly with cache-related kernel oops messages, check whether the crash occurred during or shortly after stopping nfs-server. Audit workload patterns on NFS exports for concurrent read/write delegation scenarios. Systems experiencing repeated crashes on NFS shutdown should be considered likely candidates for this vulnerability.

Why prioritize this

This is a HIGH-severity availability risk affecting core infrastructure services. Any organization with Linux-based NFS servers should prioritize patching to prevent unplanned downtime during normal service management operations. The vulnerability is not remotely exploitable in a sophisticated sense, but its trigger is likely to occur naturally in active NFS environments, making remediation urgent despite the lack of data breach or escalation potential.

Risk score, explained

CVSS 3.1 score of 7.5 reflects HIGH severity: AV:N (network-accessible NFS service), AC:L (low complexity to trigger with normal workloads), PR:N/UI:N (no authentication or user interaction required), and A:H (high availability impact via guaranteed crash). The score does not reflect confidentiality or integrity compromise, only denial of service. The absence of code execution potential prevents a CRITICAL rating despite the assured impact.

Frequently asked questions