CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->clsession is NULL; it uses clp->clslottbl), so I/O to a v4.0 flexfiles DS oopses:
- nfs4initdssession() dereferences clp->clsession->sessionstate while seeding the DS lease. It also only seeds clleasetime when NFS4SESSIONINITING is set; without a session that never happens, so clleasetime stays 0 and nfs4renewstate() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state.
- fflayoutasynchandleerrorv4() dereferences clp->clsession->fcslottable on every DS I/O error. Fall back to the v4.0 transport slot table (clp->clslottbl) when there is no session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using Linux kernel NFSv4 flexfiles with NFSv4.0 data servers are affected. The vulnerable paths specifically involve data-server clients that have no NFSv4.1+ session.
What conditions trigger the failure?
I/O to an NFSv4.0 flexfiles data server can dereference a NULL session pointer. A data-server I/O error can also trigger a NULL dereference in the asynchronous flexfiles error-handling path.
Are there operational symptoms besides the NULL dereference?
For an NFSv4.0 data server, lease time may remain zero because session initialization does not occur. This can cause nfs4_renew_state() to busy-loop and requeue every five seconds.