Linux KernelOperating system · Linux
CVE-2026-53391
A fix is available.
Upgrade to 5.15.211 / 6.1.177 or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable
No privileges
Zero-click
4 weeks old
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIn the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · low confidenceDeveloping — this CVE was published recently and its authoritative NVD entry is still being established, so we're holding a technical summary until the source data settles rather than publish something unreliable. Re-checking after 2026-08-04.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Linux KernelOperating system
Affected:
>= 4.0, < 5.15.211>= 5.16, < 6.1.177>= 6.2, < 6.6.144>= 6.7, < 6.12.95>= 6.13, < 6.18.38>= 6.19, < 7.1.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Upgrade available
Upgrade to 5.15.211 / 6.1.177 / 6.6.144 or later
Fixed in
5.15.2116.1.1776.6.144
Recommended fix
Moderate confidence
Any Linux kernel version that includes the commit rejecting zero-length r_addr/r_netid in nfs4_decode_mp_ds_addr
- Identify the current Linux kernel version running on affected systems using 'uname -r'
- Check if the running kernel version includes the fix for CVE-2026-53391 by reviewing kernel release notes or security advisories
- Obtain and install a kernel version that includes the fix for this vulnerability. The fix adds explicit checks for zero-length r_netid and r_addr in nfs4_decode_mp_ds_addr() to reject them with -EBADMSG instead of proceeding to strrchr(NULL, '.')
- Reboot the system into the patched kernel
- Verify the fix is applied by checking the kernel version and confirming pNFS/flexfile functionality works correctly
Caveat Kernel upgrades may introduce compatibility changes with existing modules or system configurations; ensure driver and module compatibility before upgrading
Generated from the published advisory — verify against the referenced sources before acting.
We can perform the upgrade in your staging environment and verify nothing breaks — typical engagement from $3,200.
Get the upgrade done
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-53391 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-53391 in production — separate from our analysis above.
Know something about CVE-2026-53391?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data