HIGH Introduced in 4.12
nfs flexfiles Deref
CVE-2026-90149
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses: - nfs4_init_ds_session() dereferences clp->cl_session->session_state while seeding the DS lease. It also only seeds cl_lease_time when NFS4_SESSION_INITING is set; without a session that never happens, so cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state. - ff_layout_async_handle_error_v4() dereferences clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.
02KernelScan AI Analysis
Risk summary
A remote attacker can trigger a kernel panic by performing I/O to an NFSv4.0 flexfiles data server, causing a NULL pointer dereference. This results in denial of service with no confidentiality or integrity impact.
Vulnerability analysis
The NFSv4 flexfiles driver assumes data server clients always have a session (NFSv4.1+), but NFSv4.0 clients do not. Two code paths dereference the NULL session pointer: one during DS lease initialization and one on every DS I/O error. The fix checks for a NULL session and falls back to the v4.0 transport slot table, and seeds the lease time unconditionally when no session exists. This is reachable from a network client performing I/O against a flexfiles data server configured for NFSv4.0.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 4.12 | 6.18.52 | 163c16e01f53 |
| 7.2 | 4.12 | 7.2.6 | 436a214514e2 |
| mainline | 4.12 | 7.3-rc1 | 2b03ebbf8d5e |