CVE-2026-53026: Linux Kernel

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access should not be called to increment the nfs4_file access count since that was already done by the thread that added READ access to the file. The extra fi_access count in nfs4_file can prevent the corresponding nfsd_file from being freed. When stopping nfs-server service, these extra access counts trigger a BUG in kmem_cache_destroy() that shows nfsd_file object remaining on __kmem_cache_shutdown. This problem can be reproduced by running the Git project's test suite over NFS.

Affected products

• Linux Linux Kernel: from 6.18.4, before 6.18.33 (fixed in 6.18.33); from 6.19.1, before 7.0.10 (fixed in 7.0.10); version 6.19 only

Published 2026-06-24. Last modified 2026-07-15.