CyberSecBulletin
CVE-2026-53398NVD status: Modified

Linux: Improper Initialization

Published Updated By the CyberSecBulletin desk

CVE-2026-53398 is a critical-severity improper initialization vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 8836405abdc53ca3dd5fc68b2cf6f8f012fad011, 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439, 5ec37edcb534f3fc92304be236d37f08e6545585 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.54% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 8836405abdc53ca3dd5fc68b2cf6f8f012fad011 or 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 or 5ec37edcb534f3fc92304be236d37f08e6545585 or 1e04be34cafae119e82bcaccd6d28a20f72a3647, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux5e76b25d7cc82c148d391c0c43b884e6427cb302 up to, but not including, 8836405abdc53ca3dd5fc68b2cf6f8f012fad011; 07b68ff5c71cf4ed5443016d8eb116863c0a4d88 up to, but not including, 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, 5ec37edcb534f3fc92304be236d37f08e6545585; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, 1e04be34cafae119e82bcaccd6d28a20f72a3647; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, 161d1aaeb04d620d3692639700512bb5038c1e10; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, c8a24effd96d4779e2ad779654682304491c55a5; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, 46eb17d45be69d28c7a23ea03283b207426a8232; 3fdc546462348b8a497c72bc894e0cde9f10fc40 up to, but not including, 9e18e83b8846a5c3fe13fc8a464b4865d33996c6; and 3 more ranges8836405abdc53ca3dd5fc68b2cf6f8f012fad011, 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439, 5ec37edcb534f3fc92304be236d37f08e6545585, 1e04be34cafae119e82bcaccd6d28a20f72a3647, 161d1aaeb04d620d3692639700512bb5038c1e10, c8a24effd96d4779e2ad779654682304491c55a5
LinuxLinux Kernel5.10.220 up to, but not including, 5.10.260; 5.15.154 up to, but not including, 5.15.211; 6.1 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"), the inline iops array is not cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore leave sin_exp holding stale union contents from a previous operation. The error response path still invokes nfsd4_secinfo_no_name_release(), which calls exp_put() on a non-NULL sin_exp. Initialize sin_exp before the first failable decode step, matching nfsd4_decode_secinfo().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Initialization

The product does not initialize or incorrectly initializes a resource.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
  • Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  • Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.

More Improper Initialization vulnerabilities (CWE-665)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Initialization vulnerabilities

Spotted an error? Tell us.