Skip to main content

Linux Kernel CVE-2026-90103

| EUVDEUVD-2026-81696 HIGH
2026-09-17 Linux GHSA-qgw9-h34w-h93j
Linux Red Hat Nfs
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Compromise or stand up malicious NFSv4.2 flexfiles server
  2. Delivery
    Victim client mounts the pNFS export
  3. Exploit
    Server returns oversized filehandle/netaddr via LAYOUTGET/GETDEVICEINFO
  4. Execution
    Client encodes LAYOUTSTATS exceeding 256-byte reservation
  5. Persist
    xdr_reserve_space returns NULL under mirror->lock
  6. Impact
    Lock permanently held, client subsystem hangs (DoS)

Vulnerability Assessment

Exploitation Conditions

The Linux client must be running and using NFSv4.2 with the flexible-files (flexfiles) pNFS layout driver and must mount an export from an attacker-controlled or compromised NFS server. That server drives the bug by returning a maximally sized filehandle (NFS_MAXFHSIZE) and netaddr via LAYOUTGET/GETDEVICEINFO so the client's LAYOUTSTATS XDR record exceeds the 256-byte reservation. Limiting factors: requires the pNFS flexfiles feature to be in use (not a default for typical NFS mounts), a trust/mount relationship with the malicious server, and it produces only a hang/DoS - no code execution or data disclosure.
Impact

Vendor CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - a pure availability/DoS issue, correctly showing C:N/I:N. This is a client-side flaw: a malicious or compromised NFSv4.2 server drives a Linux client's flexfiles pNFS LAYOUTSTATS XDR encoder past its 256-byte reservation; xdr_reserve_space() returns NULL while dss_info->mirror->lock is held, so the lock is never released, hanging the client (deadlock). I dispute AC:L: exploitation requires the victim host to have mounted an attacker-controlled/compromised NFSv4.2 flexfiles pNFS export, and the server must supply a maximally sized filehandle (NFS_MAXFHSIZE) and netaddr - a real prerequisite, so AC:H is more honest, yielding ~5.9. No EPSS, no CISA KEV, and no public exploit identified at time of analysis; there is no active-exploitation signal. Availability impact is genuine but the exposure is gated behind an uncommon deployment (pNFS flexfiles) and a trust relationship with a hostile server, so this is a moderate, config-dependent DoS rather than a widespread priority. Note the input CWE is N/A: the true weakness is improper locking / deadlock (CWE-667/CWE-833), not the tagged 'Information Disclosure'.
Exploit ScenarioDerived

An admin mounts an NFSv4.2 export using the flexible-files pNFS layout driver from a server the attacker controls or has compromised. Via LAYOUTGET and GETDEVICEINFO the server returns an NFS_MAXFHSIZE filehandle and address so that when the client emits a LAYOUTSTATS operation the flexfiles record overruns the 256-byte XDR reservation; xdr_reserve_space() returns NULL while mirror->lock is held, leaving the lock permanently taken and hanging the client. No public exploit code is identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent hang by a malicious or compromised NFS server, which returns maximally sized filehandles and network addresses through LAYOUTGET and GETDEVICEINFO so that the LAYOUTSTATS layoutupdate4 record exceeds the encoder's 256-byte reservation. When xdr_reserve_space() then returns NULL inside ff_layout_encode_io_latency(), the code path unwinds with dss_info->mirror->lock still held, leaving the lock permanently locked and hanging the client - a pure availability/denial-of-service condition with no code execution or data disclosure (C:N/I:N/A:H, vendor CVSS 3.1 7.5; our independent assessment rates the same impact but with AC:H rather than AC:L, since a hostile server, a mount relationship, and active flexfiles pNFS usage are all required). No public exploit code was identified and there is no CISA KEV entry at time of analysis; vendor-patched kernel releases are available.

RemediationAI

Apply the vendor-released kernel patch: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 or the 7.3-rc1 mainline tag, which raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so the flexfiles layoutupdate4 record cannot exhaust the send-buffer reservation; the fixes are published as stable-branch commits at https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c, https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4, https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f, https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36, https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2, https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9, https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136 and https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a, with context in https://nvd.nist.gov/vuln/detail/CVE-2026-90103. Where kernels cannot be rebuilt immediately, the effective compensating control is to eliminate the attack surface: mount NFS exports with minorversion=1 (nfsvers=4.1) or without the pNFS layout support so the v4.2 LAYOUTSTATS path is never exercised - the trade-off is loss of NFSv4.2 features and of pNFS parallel I/O performance. Alternatively unload or blacklist the flexfiles layout driver (nfs_layout_flexfiles; rmmod where it is a module, or a module_blacklist= boot parameter) so LAYOUTGET cannot hand the client a flexfiles layout, at the cost of disabling flexfiles-based pNFS entirely on that host. As a general boundary control, restrict which NFS servers a client will mount from, since exploitation requires a mount relationship with an attacker-controlled or compromised server; note that this is a containment measure only and does not remove the underlying encoder bug, and that a hung client may require a reboot or forced unmount to recover once the mirror lock is stuck.

Affected VersionsENISA

Linux patch: 7.2.6
Linux patch: 5.10.270
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <c75ef2137e749f2673f0617cfdaae53b2bb7195a
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <e82d7d999fe9f893f84bf332fd39cb5d9de7128f
Linux patch: 6.1.188
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <a973622da0c62c34043ddbbf382cd761b03e5136
Linux patch: 0
Linux patch: 6.18.52
Linux patch: 6.6.157
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <3815b894b922e9b4f40b8b6f6d67bf80d44141c9
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <842ac26615424577f24f0486b9d3bf97f28fad9c
Linux 4.2
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <cb11590c7ddc6883a1b1d70b1f98b2779fe626f2
Linux patch: 5.15.221
Linux patch: 7.3-rc1
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <397aa7000bbf6b6a0d32e66a544e978fb478c8e4
Linux 27c430644369ccd9a2272492ba6d0e85e2e4800b <5aca000630c0fd0da102ae1abf9245dd74f2ce36
Linux patch: 6.12.110

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw sits in the Linux kernel's NFS client XDR encoding path for the NFSv4.2 LAYOUTSTATS operation, part of the parallel NFS (pNFS) subsystem. The macro encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), historically 256 bytes, as a worst-case size for the layoutupdate4 body a layout driver may emit, and this reservation is used to pre-allocate space in the RPC send buffer. The flexfiles driver's ff_layout_encode_ff_layoutupdate() writes, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4 structures, an nfstime4 and a boolean: an NFS_MAXFHSIZE filehandle alone consumes 132 of the 256 reserved bytes, the two 64-byte ff_io_latency4 entries plus the timestamp and boolean add roughly 144 more, so the body already exceeds the budget before the netaddr4 is written - and encode_layoutstats() additionally writes a deviceid4 and the layoutupdate4 lou_type word that the macro never accounted for. Because both the filehandle and the device address are attacker-influenced (the server supplies them via LAYOUTGET and GETDEVICEINFO), a hostile server can deterministically push the encoder past the end of the send buffer; xdr_reserve_space() then returns NULL, and because that NULL return occurs while dss_info->mirror->lock is held in the two ff_layout_encode_io_latency() calls, the mutex is never released. No CWE identifier was supplied in the input; the root-cause classes involved are an undersized/incorrectly computed buffer reservation (out-of-bounds encode) combined with a lock-release-on-error-path defect that converts the encode failure into a persistent deadlock. The fix raises PNFS_LAYOUTSTATS_MAXSIZE to 384 so the largest legitimate flexfiles record fits inside the reservation.

Know when Nfs gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Malicious NFS server reaches the client over the network (AV:N, PR:N), but victim must mount an attacker-controlled flexfiles pNFS export with server-crafted oversized FH (AC:H); impact is a lock-hold hang only (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 18, 2026 - 18:22 NVD
7.5 (HIGH)
Patch available
Sep 17, 2026 - 17:19 EUVD
CVE Published
Sep 17, 2026 - 16:06 cve.org
HIGH 7.5
CVE Published
Sep 17, 2026 - 16:06 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that.

ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4 and the bool add a further 144, so the body passes 256 bytes before the netaddr4 is encoded at all. encode_layoutstats() additionally writes the deviceid4 and the layoutupdate4 lou_type word, neither of which the macro accounts for.

The filehandle and the address are both chosen by the server, through LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the end of the send buffer. xdr_reserve_space() returns NULL once that happens, and the two ff_layout_encode_io_latency() calls run with dss_info->mirror->lock held, so a NULL return there leaves the lock permanently held.

Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the reservation.

Executive ViewAI

Why It Matters

Linux kernel NFSv4.2 clients using the flexfiles pNFS layout driver can be permanently hung by a malicious or compromised NFS server, causing a denial-of-service condition that disrupts access to file shares. This affects organizations that rely on NFSv4.2 for critical data sharing and permit connections to untrusted NFS servers; leadership should care because a single hostile server can disable multiple clients, requiring manual reboots and potentially halting business operations.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Ubiquitous
Linux kernel runs almost everywhere; but NFSv4.2 flexfiles pNFS client path is niche
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Nfs

View all
CVE-2026-90104 CRITICAL
9.8 Sep 17

A syntactically valid NFSv4.1 CB_SEQUENCE callback that carries an empty referring_call_list can leave an uninitialized

CVE-2026-90102 HIGH
7.5 Sep 17

NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client w
CVE-2026-90149 HIGH
7.5 Sep 17

NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote

CVE-2026-90234 HIGH
7.5 Sep 17

Linux kernel NFSv4 clients can be driven into an endless state-recovery loop that leaves the mounting host unable to cle

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90103 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 ADVISORY https://ubuntu.com/security/notices/USN-8961-1 ADVISORY https://ubuntu.com/security/notices/USN-8962-1 ADVISORY https://ubuntu.com/security/notices/USN-8963-1 ADVISORY https://vuldb.com/vuln/406607 REF https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9 REF https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4 REF https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36 REF https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c REF https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136 REF https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a REF https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2 REF https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy