What is the CVSS score of CVE-2026-90102?

CVE-2026-90102 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-90102?

Within 24 hours, inventory all Linux hosts running NFS client workloads with the pNFS/flexfiles capability enabled (CONFIG_NFS_V4_1), confirm which of them mount pNFS volumes served by a flexfiles layout driver, and prioritize those hosts for remediation; confirm the current kernel package version on each so patching can be tracked against the vendor's fix. Within 7 days, apply the vendor-released kernel update per the advisory - installing the distribution's fixed kernel package (for example the corrected kernel or kernel-default/kernel-core package for your distribution and release line, following your vendor's advisory for the exact fixed version) and scheduling reboots during maintenance windows so the running kernel is replaced, not merely installed. Within 30 days, verify post-reboot that the patched kernel is active on every affected host, re-scan to confirm no hosts remain on vulnerable versions, and where immediate patching is impossible, isolate those clients or move them off flexfiles-based pNFS mounts until the update can be deployed.

Linux Kernel CVE-2026-90102

Q: Which versions of Linux Kernel are affected by CVE-2026-90102?

A flaw in the Linux kernel's pNFS flexfiles data-server cache can crash any Linux host that mounts a parallel NFS filesystem served by a flexfiles layout, resulting in an unplanned outage of that…. A patch is available.

EUVD-2026-81695 HIGH

2026-09-17 Linux

GHSA-wj5v-2g3c-hmrh

Linux Red Hat Nfs

7.5

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Client mounts pNFS flexfiles export
Delivery

Malicious server returns mixed-version mirror deviceids
Exploit

Data-server cache aliases one nfs4_pnfs_ds across versions
Execution

Mismatched rpc_call_ops / sequence-slot handling
Persist

NULL-pointer dereference
Impact

Kernel oops (denial of service)

Vulnerability Assessment

Exploitation Conditions	Requires the Linux host to act as an NFS client mounting a pNFS filesystem served by the flexfiles layout driver (CONFIG_NFS_V4_1 / flexfiles), and to connect to an NFS server (malicious or misconfigured) whose GETDEVICEINFO returns two deviceids/mirrors that share a single multipath address but carry different major NFS versions (e.g. one v3 and one v4). The files layout driver is unaffected because it hardcodes version 4. This is not a default configuration: mixed-version mirrors on one data-server address are uncommon, and the crash is client-side, so the practical trigger is a hostile or broken data server rather than an arbitrary remote attacker.
Impact	The vendor CVSS3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) correctly scores this as an availability-only flaw: the NULL-pointer dereference produces a kernel oops/crash, with no confidentiality or integrity impact (C:N/I:N). That directly contradicts the 'Information Disclosure' tag, which is wrong for a pure DoS. The signals otherwise point to LOW real-world priority: no EPSS score, not in CISA KEV, and no public POC identified. The AV:N/AC:L rating overstates realistic ease - this is a client-side bug where the Linux NFS client crashes, and it is only reachable when the client mounts a pNFS flexfiles layout AND the NFS server returns two mirror deviceids sharing one multipath address but with different major NFS versions (e.g. one v3, one v4). That is a niche, essentially malicious-or-misconfigured-server precondition, so effective attack complexity is high. Net: a legitimate but low-urgency stability/DoS fix, not a widely exploitable critical bug. CWE is listed as N/A but this is unambiguously CWE-476 (NULL pointer dereference).
Exploit ScenarioDerived	A Linux host mounts a pNFS filesystem using the flexfiles layout driver from an attacker-controlled or misconfigured NFS server. The server's GETDEVICEINFO responses advertise two device mirrors on the same multipath address but with different major NFS versions; the client's data-server cache aliases them onto one nfs4_pnfs_ds pinned to the first version, so the second mirror is driven with rpc_call_ops for a version the connection does not speak, dereferencing NULL and crashing the kernel. No public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client when it mounts a pNFS filesystem served by the flexfiles layout driver and connects to a server whose GETDEVICEINFO response returns two deviceids sharing one multipath data-server address but advertising different major NFS versions. The cache in nfs4_pnfs_ds_add() is keyed only on the address set, so the two mirrors alias to a single nfs4_pnfs_ds; whichever mirror connects first pins the client to its own NFS version, and the second mirror is then handed that client and selects rpc_call_ops for a protocol version the connection does not speak, causing mismatched sequence-slot handling and a kernel oops. The flaw is availability-only (no confidentiality or integrity impact), affects only hosts acting as NFS clients that mount pNFS with the flexfiles layout (CONFIG_NFS_V4_1), and there is no public exploit identified at time of analysis; exploitation requires the uncommon condition of mixed-version mirrors on a single data-server address, which is why our independent assessment raises attack complexity to AC:H relative to the vendor vector's AC:L.

RemediationAI

Vendor-released patch: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 or 7.2.6 (or 7.3-rc1 or later), each of which carries the fix that adds the NFS major version to the data-server cache key so mixed-version mirrors on one address no longer alias; the individual stable backports are at https://git.kernel.org/stable/c/ffb100b0da0e217d5d63ce6fe092f9c29e59f7dd, https://git.kernel.org/stable/c/02e160922bc83cd25e346a028ed43cbdb0b57e1a, https://git.kernel.org/stable/c/bc7aa9d8aff826031ffe25eba7f2f3acafcbf7a1, https://git.kernel.org/stable/c/dd5bd091daa48c6ed8f9235ddf448aa288a0881f, https://git.kernel.org/stable/c/f2994ba1263d9e88d3d9ae1d097c5cf811d4bfa5, https://git.kernel.org/stable/c/27f640cd92eebf5c2f64336be7ca24f4636390cb, https://git.kernel.org/stable/c/bbc975cfb07a146843fde1126c43441e76177539 and https://git.kernel.org/stable/c/13c23c5cb977f66390795437fd3837887ce1fd75, with context in https://nvd.nist.gov/vuln/detail/CVE-2026-90102 and https://vuldb.com/vuln/406618. If immediate upgrading is not possible, the practical compensating controls are to stop mounting pNFS filesystems through the flexfiles layout against servers that advertise different NFS major versions on the same data-server address - for example by using the files layout driver (which hardcodes version 4 and never hits this alias) or by constraining /etc/nfsmount.conf and mount options to force a single NFS version against a trusted metadata server; the trade-off is loss of flexfiles-specific features and reduced layout flexibility on heterogeneous servers. A further option is to restrict NFS mounts to trusted, internally controlled servers, since the trigger is a hostile or misconfigured data server returning cross-version mirrors; this limits exposure but does not remove the bug from the client, and a crash still results in a kernel oops that can interrupt all I/O on the host, so patching remains the only complete fix.

Affected VersionsENISA

Linux d67ae825a59d639e4d8b82413af84d854617a87e <f2994ba1263d9e88d3d9ae1d097c5cf811d4bfa5

Linux d67ae825a59d639e4d8b82413af84d854617a87e <02e160922bc83cd25e346a028ed43cbdb0b57e1a

Linux d67ae825a59d639e4d8b82413af84d854617a87e <bbc975cfb07a146843fde1126c43441e76177539

Linux patch: 6.18.52

Linux patch: 7.2.6

Linux 4.0

Linux patch: 5.10.270

Linux patch: 0

Linux patch: 7.3-rc1

Linux d67ae825a59d639e4d8b82413af84d854617a87e <ffb100b0da0e217d5d63ce6fe092f9c29e59f7dd

Linux d67ae825a59d639e4d8b82413af84d854617a87e <bc7aa9d8aff826031ffe25eba7f2f3acafcbf7a1

Linux d67ae825a59d639e4d8b82413af84d854617a87e <dd5bd091daa48c6ed8f9235ddf448aa288a0881f

Linux d67ae825a59d639e4d8b82413af84d854617a87e <27f640cd92eebf5c2f64336be7ca24f4636390cb

Linux patch: 6.1.188

Linux patch: 6.12.110

Linux d67ae825a59d639e4d8b82413af84d854617a87e <13c23c5cb977f66390795437fd3837887ce1fd75

Linux patch: 5.15.221

Linux patch: 6.6.157

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a defect in the Linux kernel's NFSv4.1 pNFS client, specifically the flexfiles layout driver. In pNFS, the metadata server returns a layout plus GETDEVICEINFO responses describing data servers; each deviceid carries a ds_versions tuple, and the client caches a struct nfs4_pnfs_ds per network namespace keyed by the multipath address set in nfs4_pnfs_ds_add(). That key is sufficient for the files layout driver, which always connects with NFS version 4, but flexfiles takes its version tuple per device, and a single address can legitimately serve both NFSv3 and NFSv4. When two deviceids share an address but differ in ds_versions[0].version, they collide on one nfs4_pnfs_ds; the first mirror to connect sets ds_clp, and the second is handed that already-versioned client, so it selects rpc_call_ops/rpc_ops for the wrong protocol version and the mismatched sequence-slot handling dereferences a NULL pointer, producing a kernel oops (a client-side crash). The upstream fix adds the major version to the cache key so the two entries cannot alias, leaving v4.0 and v4.1 sharing a client because only the major version selects the call/session operations; the files layout driver passes the hardcoded 4 it already uses at connect time. The CVE record assigns no CWE, but the defect class is a NULL-pointer dereference (CWE-476) rooted in an incomplete cache key / improper alias handling. Note the attached tags label this as 'Information Disclosure', which is inconsistent with the vendor and independently assessed impact: the CVSS:3.1 vectors from the vendor (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and from our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both set C:N/I:N and describe an availability-only outcome. CPE coverage is generic (cpe:2.3:a:linux:linux:*) because the affected code lives in the mainline kernel tree rather than a separately versioned package.

Know when Nfs gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.9 MEDIUM

Client-side crash triggered by a hostile NFS server response; reachable only with pNFS flexfiles plus mixed-version mirrors on one address, so AC:H; pure crash, so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 18, 2026 - 18:22 NVD

7.5 (HIGH)

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:06 cve.org

HIGH 7.5

CVE Published

Sep 17, 2026 - 16:06 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pnfs: key the data server cache on the NFS version

nfs4_pnfs_ds_add() keys the per-net data server cache on the multipath address set alone, and struct nfs4_pnfs_ds records no version. That suffices for the files layout driver, which always connects with version 4, but flexfiles takes its version tuple from GETDEVICEINFO per device, and one address can legitimately serve both NFSv3 and NFSv4.

Two deviceids on one address with different ds_versions[0].version therefore share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other one is handed that client anyway, so it selects rpc_call_ops for a version the connection does not speak, and the mismatched sequence-slot handling dereferences NULL.

Add the version to the cache key so the two cannot alias, giving each version its own nfs4_pnfs_ds and connection while both mirrors stay usable. Only the major version is compared, since that is what selects rpc_call_ops and rpc_ops; v4.0 and v4.1 keep sharing a client. The files layout driver passes the 4 it already hardcodes at connect time.

Executive ViewAI

Why It Matters

A flaw in the Linux kernel's pNFS flexfiles data-server cache can crash any Linux host that mounts a parallel NFS filesystem served by a flexfiles layout, resulting in an unplanned outage of that host rather than any data exposure or corruption. Only client-side storage workloads using this specific pNFS configuration are affected, so exposure is concentrated in engineering, research, and data-platform environments that rely on pNFS-mounted storage. Because the failure mode is a kernel-level crash, the operational consequence is loss of service on the affected client until the host recovers, making timely kernel patching important for teams with availability-sensitive NFS workloads.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Low

Linux kernel ubiquitous, but pNFS flexfiles client with mixed-version mirrors rarely deployed

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

More in Nfs

View all

CVE-2026-90104 CRITICAL Act Now

9.8 Sep 17

A syntactically valid NFSv4.1 CB_SEQUENCE callback that carries an empty referring_call_list can leave an uninitialized

CVE-2026-90103 HIGH This Week

7.5 Sep 17

Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent h

CVE-2026-90149 HIGH This Week

7.5 Sep 17

NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote

CVE-2026-90234 HIGH This Week

7.5 Sep 17

Linux kernel NFSv4 clients can be driven into an endless state-recovery loop that leaves the mounting host unable to cle

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back