CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->clsession is NULL; it uses clp->clslottbl), so I/O to a v4.0 flexfiles DS oopses:

- nfs4initdssession() dereferences clp->clsession->sessionstate while seeding the DS lease. It also only seeds clleasetime when NFS4SESSIONINITING is set; without a session that never happens, so clleasetime stays 0 and nfs4renewstate() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state.

- fflayoutasynchandleerrorv4() dereferences clp->clsession->fcslottable on every DS I/O error. Fall back to the v4.0 transport slot table (clp->clslottbl) when there is no session.

Affected Software

1 affected component

Linux Kernel

Event History

Sep 17, 2026

CVE Published

via MITRE·04:06 PM

Data Sourced

via MITRE·04:06 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using Linux kernel NFSv4 flexfiles with NFSv4.0 data servers are affected. The vulnerable paths specifically involve data-server clients that have no NFSv4.1+ session.

What conditions trigger the failure?

I/O to an NFSv4.0 flexfiles data server can dereference a NULL session pointer. A data-server I/O error can also trigger a NULL dereference in the asynchronous flexfiles error-handling path.

Are there operational symptoms besides the NULL dereference?

For an NFSv4.0 data server, lease time may remain zero because session initialization does not occur. This can cause nfs4_renew_state() to busy-loop and requeue every five seconds.