CVE-2026-53392

NFSv4/flexfiles: reject zero filehandle version count

State: Published
Severity: 7.5 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: reject zero filehandle version count

ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL.

A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists.

Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	d67ae825a59d639e4d8b82413af84d854617a87e to before 9033591535c066726f5b505126ccb4068b98fa4fAffected d67ae825a59d639e4d8b82413af84d854617a87e to before 18cc6d57a14fa65ab2a2b52279f549041c4bc9cfAffected d67ae825a59d639e4d8b82413af84d854617a87e to before be7829715e341b42846437dd9e721005db59f0ccAffected d67ae825a59d639e4d8b82413af84d854617a87e to before eeabb9020721db6bc132e68eeae380b8d4fb4b04Affected d67ae825a59d639e4d8b82413af84d854617a87e to before 7779c85028a0676fb190cde4f0c540f4f8e97761Affected d67ae825a59d639e4d8b82413af84d854617a87e to before d8c90c7cc061265d5f2813a1f5c82ef2f4707e67Affected d67ae825a59d639e4d8b82413af84d854617a87e to before 2131ed64b767ffa8bcdb3677d90f3964e39aabc8Affected d67ae825a59d639e4d8b82413af84d854617a87e to before 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2Affected
LinuxLinux	4.0Affected before 4.0Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d67ae825a59d639e4d8b82413af84d854617a87e to before 9033591535c066726f5b505126ccb4068b98fa4fAffected
d67ae825a59d639e4d8b82413af84d854617a87e to before 18cc6d57a14fa65ab2a2b52279f549041c4bc9cfAffected
d67ae825a59d639e4d8b82413af84d854617a87e to before be7829715e341b42846437dd9e721005db59f0ccAffected
d67ae825a59d639e4d8b82413af84d854617a87e to before eeabb9020721db6bc132e68eeae380b8d4fb4b04Affected
d67ae825a59d639e4d8b82413af84d854617a87e to before 7779c85028a0676fb190cde4f0c540f4f8e97761Affected
d67ae825a59d639e4d8b82413af84d854617a87e to before d8c90c7cc061265d5f2813a1f5c82ef2f4707e67Affected
d67ae825a59d639e4d8b82413af84d854617a87e to before 2131ed64b767ffa8bcdb3677d90f3964e39aabc8Affected
d67ae825a59d639e4d8b82413af84d854617a87e to before 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2Affected

LinuxLinux

4.0Affected
before 4.0Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.