Skip to main content

Linux Kernel CVE-2026-53392

| EUVDEUVD-2026-45514 HIGH
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-3gfh-mq5v-c264
Linux Denial Of Service Null Pointer Dereference
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-triggered crash but requires attacker-controlled/impersonated NFS server and a client using pNFS flexfiles, so AC:H; impact is availability-only (kernel panic), hence C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:23 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:01 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: reject zero filehandle version count

ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL.

A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists.

Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

AnalysisAI

Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.

Technical ContextAI

The vulnerable code is in the kernel's NFSv4.x parallel-NFS (pNFS) flexfiles layout driver (fs/nfs/flexfilelayout). When a flexfiles layout is granted, ff_layout_alloc_lseg() XDR-decodes a per-mirror data-storage-server descriptor that contains an array of filehandle versions; the decoded count is passed directly to kzalloc_objs() as the object count. The pre-patch logic only checked for a NULL return, but a count of zero causes the kernel slab allocator to return ZERO_SIZE_PTR (0x10-region sentinel) rather than NULL. That sentinel is stored in dss_info->fh_versions, and downstream flexfiles code such as ff_layout_encode_ff_layoutupdate() assumes at least one filehandle version exists, dereferencing the sentinel. The CWE was not assigned in the input, but the root cause is a NULL/sentinel-pointer dereference (CWE-476) arising from missing input validation (CWE-20) of an attacker-controlled length field. Affected CPEs are cpe:2.3:a:linux:linux (kernel), specifically builds with CONFIG_PNFS_FLEXFILE_LAYOUT and clients that actually mount pNFS flexfiles exports. The fix mirrors an existing zero-version_count check already present in the flexfiles GETDEVICEINFO parser.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.12.96, 6.18.38, 7.1.3, or 7.2-rc1 (or your distribution's backported build carrying stable commits 7779c85028a0 / d8c90c7cc061 / 2131ed64b767 / 2c6bb3c40bc2 from git.kernel.org/stable). The fix adds a fh_count == 0 rejection before allocation, matching the existing GETDEVICEINFO zero-version_count validation. If you cannot patch immediately, the practical compensating control is to avoid the vulnerable code path: only mount NFS shares from trusted, authenticated servers and avoid pNFS flexfiles layouts from untrusted sources - mount with NFSv3 or a non-flexfiles/non-pNFS configuration where operationally acceptable (side effect: loss of pNFS parallel-I/O performance benefits), and enforce Kerberos (sec=krb5) plus network segmentation so an attacker cannot impersonate or MITM the NFS server (side effect: added Kerberos administration overhead). Blocking or restricting client access to only known-good NFS server IPs on ports 2049/111 further reduces exposure. Consult the referenced kernel.org stable commit URLs and your distro's advisory for the exact backport version applicable to your kernel series.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-53392 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy