CVE-2026-53395

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix dead ACL conflict guard in nfsd4_create

nfsd4create() steals create->crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code:

if (create->cr_acl) {
    if (create->cr_dpacl || create->cr_pacl)  /* always false */

When a client encodes both FATTR4WORD0ACL and FATTR4WORD2POSIX_{DEFAULT,ACCESS}ACL in the same CREATE fattr bitmap, nfsd4acltoattr() overwrites attrs.napacl/nadpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion.

Fix by checking attrs.nadpacl/napacl (the stolen values) instead of the nilled create->crdpacl/crpacl, matching the correct pattern already used in nfsd4_setattr().