SB2026062675 - Improper resource shutdown or release in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-53244)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nfsd4_create_file() when handling NFS file creation on exported filesystems that use ->atomic_create and an error is returned. A remote user can trigger a file creation operation that causes atomic_create() to return an error to cause a denial of service.

The issue can leave the parent directory locked because an error pointer is passed to end_creating().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/e824bbd4d224cce4b5fb59cc9dcd3447fe0b7e44
• https://git.kernel.org/stable/c/ee1f40759a50b1800c98c1c369afd5b3e44ad987