UBUNTU-CVE-2026-90149: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->clsession is NULL; it uses clp->clslottbl), so I/O to a v4.0 flexfiles DS oopses: - nfs4initdssession() dereferences clp->clsession->sessionstate while seeding the DS lease. It also only seeds clleasetime when NFS4SESSIONINITING is set; without a session that never happens, so clleasetime stays 0 and nfs4renewstate() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state. - fflayoutasynchandleerrorv4() dereferences clp->clsession->fcslottable on every DS I/O error. Fall back to the v4.0 transport slot table (clp->clslottbl) when there is no session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Systems using NFSv4 flexfiles with NFSv4.0 data servers are affected. The issue applies to the listed Ubuntu Linux kernel packages, including linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle.
What conditions trigger the failure?
I/O to an NFSv4.0 flexfiles data server can trigger a NULL-pointer dereference because NFSv4.0 clients do not have a session object. A data-server I/O error can also reach a path that dereferences the missing session slot table.
What is the operational impact?
The kernel can oops during I/O to an affected data server. Additionally, the lease time may remain zero, causing state renewal to busy-loop and requeue every five seconds.
Is interaction required to exploit this issue?
The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and user interaction required. The technical description specifically identifies I/O and I/O-error handling involving an NFSv4.0 flexfiles data server as the triggering conditions.