{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg",
    "id" : "2492454",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492454"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-911",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nNFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg\nIn nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already\nset by another thread, __nfs4_file_get_access should not be called\nto increment the nfs4_file access count since that was already done\nby the thread that added READ access to the file. The extra fi_access\ncount in nfs4_file can prevent the corresponding nfsd_file from being\nfreed.\nWhen stopping nfs-server service, these extra access counts trigger a\nBUG in kmem_cache_destroy() that shows nfsd_file object remaining on\n__kmem_cache_shutdown.\nThis problem can be reproduced by running the Git project's test\nsuite over NFS.", "A flaw was found in the Linux kernel's Network File System Daemon (NFSD). An issue with file access counting in the nfsd4_add_rdaccess_to_wrdeleg function can lead to an extra access count for nfs4_file objects. This prevents the proper freeing of associated resources when the NFS server service is stopped. Consequently, this can trigger a system bug during shutdown, potentially leading to a Denial of Service (DoS) condition." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:61887",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.50.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-53026\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53026\nhttps://lore.kernel.org/linux-cve-announce/2026062453-CVE-2026-53026-0965@gregkh/T" ],
  "name" : "CVE-2026-53026",
  "csaw" : false
}