CVE-2026-90149

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

State: Published
Severity: 7.5 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses:

- nfs4_init_ds_session() dereferences clp->cl_session->session_state while seeding the DS lease. It also only seeds cl_lease_time when NFS4_SESSION_INITING is set; without a session that never happens, so cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state.

- ff_layout_async_handle_error_v4() dereferences clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a7878ca140084ec267ede48fce64d7e60f6d873e to before e55d7fec8a9290f73032ee34c35dd68532809633Affected a7878ca140084ec267ede48fce64d7e60f6d873e to before 336b6da10021c69a8f273bbacdf7432fdc89a06fAffected a7878ca140084ec267ede48fce64d7e60f6d873e to before 5527af72b0100c94287bfec901b6313eeac567caAffected a7878ca140084ec267ede48fce64d7e60f6d873e to before 163c16e01f53fc8eb8d0f3484ae6c382265ecbbdAffected a7878ca140084ec267ede48fce64d7e60f6d873e to before 436a214514e24103159aea455147d58b44a8a585Affected a7878ca140084ec267ede48fce64d7e60f6d873e to before 2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32ccAffected
LinuxLinux	4.12Affected before 4.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a7878ca140084ec267ede48fce64d7e60f6d873e to before e55d7fec8a9290f73032ee34c35dd68532809633Affected
a7878ca140084ec267ede48fce64d7e60f6d873e to before 336b6da10021c69a8f273bbacdf7432fdc89a06fAffected
a7878ca140084ec267ede48fce64d7e60f6d873e to before 5527af72b0100c94287bfec901b6313eeac567caAffected
a7878ca140084ec267ede48fce64d7e60f6d873e to before 163c16e01f53fc8eb8d0f3484ae6c382265ecbbdAffected
a7878ca140084ec267ede48fce64d7e60f6d873e to before 436a214514e24103159aea455147d58b44a8a585Affected
a7878ca140084ec267ede48fce64d7e60f6d873e to before 2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32ccAffected

LinuxLinux

4.12Affected
before 4.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.