CVE-2026-53244: Linux Kernel NFS Lock Leak Denial of Service

Technical summary

The vulnerability resides in the Linux kernel's VFS layer, specifically in the interaction between dentry_create() and nfsd4_create_file(). The root cause involves a reference-handling mismatch: atomic_create() is designed to drop a dentry reference on error and return an error pointer, a behavior that was carried into dentry_create(). However, the introduction of start_creating()/end_creating() helper functions requires nfsd4_create_file() to have a valid (non-error) dentry to properly unlock the parent directory. When atomic_create() fails on supported filesystems, an error pointer is passed to end_creating(), which then fails to release the parent directory's lock. The fix ensures dentry_create() always returns a valid dentry structure with the actual error communicated through the existing error-return mechanism, preserving invariants for callers that depend on valid dentry pointers for cleanup.

Business impact

Organizations running NFS servers or services that export filesystems supporting atomic create operations face potential availability disruption. A compromised or malicious NFS client can trigger the condition repeatedly, causing parent directories to become locked and blocking all filesystem operations within those trees. This directly impacts service availability, backup operations, and any dependent applications relying on those exported shares. For environments where NFS is critical infrastructure (storage clusters, backup targets, shared compute resources), this can cascade into widespread outages.

Affected systems

The vulnerability affects the Linux kernel across all versions that contain both the atomic_create() mechanism and the start_creating()/end_creating() refactoring. Systems are vulnerable if: (1) they run an affected kernel version, (2) they export filesystems via NFS (nfsd), and (3) those filesystems use the atomic_create operation. This includes both dedicated NFS servers and systems running nfsd for any purpose. Desktop and workstation Linux systems are generally at lower risk unless they are configured as NFS exporters.

Exploitability

Exploitability requires network access to an NFS server and the ability to initiate file creation requests that trigger atomic_create() failures. No special privileges or credentials are strictly necessary if the NFS export permits such operations—many NFS configurations allow this from any network client. However, practical exploitation requires either legitimate access to the NFS share or the ability to reach the NFS service over the network. The vulnerability is not remotely exploitable against systems not running nfsd, and requires at minimum NFS network exposure. The condition is reliably triggerable by any authorized or unauthorized NFS client that can issue CREATE requests to affected filesystems.

Remediation

Apply kernel patches that fix the dentry_create() function to ensure error conditions are handled without dropping the dentry reference prematurely, and that end_creating() always receives a valid dentry pointer. Verify patches against your Linux distribution's security advisory, as backports and patch versions vary by distribution. For immediate mitigation, restrict NFS export access via firewall rules, IP-based ACLs, or authentication mechanisms to trusted clients only. Disable atomic_create support on exported filesystems if feasible through mount options or filesystem configuration, though this may impact performance. Monitor for unexplained lock contention or hanging filesystem operations on NFS-exported directories.

Patch guidance

Consult your Linux distribution's security update channels (kernel.org security advisories, Red Hat Security Advisories, Ubuntu Security Notices, SUSE Security Updates, etc.) for patched kernel versions specific to your distribution and architecture. The fix will be included in patched kernel releases post-2026-06-25. Verify the patch commit addresses dentry_create() reference handling and end_creating() invocation safety. Test patches in a non-production environment before deployment, particularly if your NFS exports support atomic_create. Many distributions have released or will release kernel updates; subscribe to your vendor's security mailing lists for notification.

Detection guidance

Monitor system logs for NFS-related locking warnings, particularly messages about held locks on parent inodes or stuck nfsd threads. Enable kernel lock debugging (CONFIG_DEBUG_LOCK_ALLOC, lockdep) in non-production systems to detect lock contention anomalies. Watch for NFS client timeouts or ESTALE errors originating from specific directories, which may indicate a locked parent. Audit NFS mount options and exported filesystem types to identify which systems use atomic_create. Correlate NFS client activity with lock-hold duration spikes; legitimate operations should release locks within milliseconds. On affected NFS servers, monitor nfsd thread states for unusual blocking patterns.

Why prioritize this

This vulnerability merits immediate attention despite its HIGH (not CRITICAL) CVSS score due to its denial-of-service nature and availability impact. It affects infrastructure-critical services (NFS/storage), is easily triggerable by any network-connected NFS client with minimal privileges, and requires no user interaction or complex preconditions. The impact is not data compromise but operational continuity—a core concern for production environments. Organizations exporting NFS shares should prioritize patching their kernel versions within standard SLA windows, typically days to weeks depending on risk posture.

Risk score, explained

CVSS 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, causing availability loss but not confidentiality or integrity compromise. The score does not account for the rarity of certain atomic_create() error paths or deployment-specific factors (e.g., organizations not running nfsd). In practice, risk is elevated for NFS-dependent infrastructure and reduced for client-only systems. The HIGH severity appropriately flags this as a priority patch candidate for systems matching the affected profile, particularly those in managed storage or high-availability roles.

Frequently asked questions