Skip to main content

Linux Kernel CVE-2026-90149

| EUVDEUVD-2026-81742 HIGH
2026-09-17 Linux GHSA-5pv5-p9q3-rvv6
Linux Nfs
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Client mounts pNFS flexfiles layout
  2. Delivery
    Layout references NFSv4.0 data server
  3. Exploit
    Client I/O or DS returns I/O error
  4. Execution
    v4 path derefs NULL cl_session
  5. Impact
    Kernel NULL-deref oops / renew busy-loop (client DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the client kernel to be built and configured for pNFS with the flexfiles layout driver AND the served layout to reference an NFSv4.0 data server (NFSv4.1+ data servers have a session and are unaffected, since clp->cl_session is non-NULL). The nfs4_init_ds_session() NULL deref / lease busy-loop triggers when seeding the DS lease for a sessionless v4.0 client; the ff_layout_async_handle_error_v4() NULL deref triggers only on a DS I/O error. Impact is limited to a client-side crash or CPU-spinning renew loop - no code execution and no data exposure. Not reachable in default NFS mounts, non-pNFS setups, or all-v4.1+ data-server deployments; affects kernels from 4.12 up to the fixed 7.2.6 / 6.18.52 / 7.3-rc1 releases.
Impact

This is a genuine but narrowly-scoped, low-priority client-side denial-of-service in the Linux kernel NFS client, not a high-real-risk issue despite the vendor's 7.5 rating. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) correctly captures a pure availability impact (C:N/I:N) - there is NO confidentiality or integrity loss, so the 'Information Disclosure' tag is inaccurate. I disagree with AC:L: reaching the two crash paths requires the client to be configured for pNFS with the flexfiles layout, be talking to an NFSv4.0 (not v4.1+) data server, and - for the ff_layout_async_handle_error_v4() path - hit a DS I/O error; the nfs4_init_ds_session() busy-loop also only manifests for a sessionless v4.0 DS. Those compound preconditions justify AC:H, lowering my assessed score to ~5.9. No EPSS score, no CISA KEV entry, and no public exploit are present in the input, consistent with a client-side robustness bug rather than an attacker-driven target. There is no CWE assigned in the input; the correct class is CWE-476 (NULL pointer dereference), with a secondary busy-loop (cl_lease_time stays 0 → nfs4_renew_state() requeues every 5s). Bottom line: real bug, real patch, but low operational urgency outside environments running pNFS flexfiles against v4.0 data servers.
Exploit ScenarioDerived

A Linux NFS client is configured to use pNFS with the flexfiles layout and mounts a filesystem whose layout points to an NFSv4.0 (sessionless) data server. When the client performs I/O to that v4.0 DS - or when a DS I/O error occurs - the kernel dereferences the NULL clp->cl_session (expecting a v4.1+ session) in nfs4_init_ds_session() or ff_layout_async_handle_error_v4(), oopsing the client; separately the un-seeded cl_lease_time causes nfs4_renew_state() to busy-loop every 5 seconds. No public exploit code is identified in the provided data, and exploitation yields only a client-side crash/hang, not code execution or data disclosure.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote party - specifically an NFSv4.0 data server referenced by a flexfiles layout - to crash the mounting client or drive its DS lease-renewal path into a busy-loop, yielding client-side denial of service (assessed AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) with no code execution and no data exposure. The defect affects kernels from 4.12 up to the fixed releases 6.18.52, 7.2.6 and 7.3-rc1, but is reachable only where the client kernel is built and configured for pNFS with the flexfiles layout driver and the served layout points at a sessionless NFSv4.0 data server; NFSv4.1+ data servers carry a session and are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor's 7.5 (AC:L) score overstates practical reachability given the configuration prerequisites reflected in the AC:H assessment.

RemediationAI

Vendor-released patch: update to Linux 6.18.52, 7.2.6, or 7.3-rc1 (or a later stable release containing the corresponding backports), which include commits 163c16e01f53fc8eb8d0f3484ae6c382265ecbbd, 436a214514e24103159aea455147d58b44a8a585, and 2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc as listed at https://git.kernel.org/stable/c/163c16e01f53fc8eb8d0f3484ae6c382265ecbbd. Until kernels can be rebuilt, the most effective compensating control is to eliminate the trigger condition: avoid exposing NFSv4.0 data servers in flexfiles layouts, either by using NFSv4.1/4.2 data servers (which have clp->cl_session and are unaffected) or by not deploying the flexfiles pNFS layout driver on affected clients - for example, mounting without pNFS/flexfiles layout support on the client, at the cost of losing parallel-NFS striping performance, or restricting the mount to a v4.1+ server dialect, which older storage arrays may not support. Because the crash triggers on the DS I/O path rather than at mount time, blocking the specific flexfiles data-server addresses at the client firewall provides only partial mitigation (it prevents the error-path dereference but not the lease busy-loop if a v4.0 DS lease is ever seeded) and may itself cause I/O errors that hit the vulnerable code; there is no configuration switch that fixes the NULL dereference itself, so patching remains the definitive fix.

Affected VersionsENISA

Linux 4.12
Linux patch: 7.3-rc1
Linux a7878ca140084ec267ede48fce64d7e60f6d873e <2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc
Linux a7878ca140084ec267ede48fce64d7e60f6d873e <436a214514e24103159aea455147d58b44a8a585
Linux patch: 7.2.6
Linux patch: 0
Linux a7878ca140084ec267ede48fce64d7e60f6d873e <163c16e01f53fc8eb8d0f3484ae6c382265ecbbd
Linux patch: 6.18.52

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code lives in the Linux kernel NFSv4 client's pNFS flexfiles layout driver, which permits NFSv4.0 data servers (DS) even though key NFSv4.0 client state differs from NFSv4.1+. An NFSv4.0 client has no session, so clp->cl_session is NULL and slot/transport information instead lives in clp->cl_slot_tbl; the flexfiles path, however, assumed a session in two places. First, nfs4_init_ds_session() dereferences clp->cl_session->session_state while seeding the DS lease, and it only sets cl_lease_time when NFS4_SESSION_INITING is set - which never happens without a session - leaving cl_lease_time at 0 and causing nfs4_renew_state() to requeue itself every 5 seconds in a CPU-spinning busy-loop; the fix seeds the lease whenever no session exists and returns before touching session state. Second, ff_layout_async_handle_error_v4() dereferences clp->cl_session->fc_slot_table on every DS I/O error, so the fix falls back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session. The input assigns no CWE, but the root-cause class is a NULL pointer dereference (CWE-476) in NFS client connection/session handling; the affected CPE is cpe:2.3:a:linux:linux. Notably, EUVD tagging labels the issue "Information Disclosure," yet the assessed vector and the patch content describe a memory-safety/DoS condition on the client only, with no confidentiality or integrity impact.

Know when Nfs gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Client-side crash driven by a v4.0 data server over the network (AV:N) but gated on pNFS flexfiles + v4.0 DS + I/O error (AC:H); pure availability impact so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 18, 2026 - 18:22 NVD
7.5 (HIGH)
Patch available
Sep 17, 2026 - 17:19 EUVD
CVE Published
Sep 17, 2026 - 16:06 cve.org
HIGH 7.5
CVE Published
Sep 17, 2026 - 16:06 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses:

  • nfs4_init_ds_session() dereferences clp->cl_session->session_state

while seeding the DS lease. It also only seeds cl_lease_time when NFS4_SESSION_INITING is set; without a session that never happens, so cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state.

  • ff_layout_async_handle_error_v4() dereferences

clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.

Executive ViewAI

Why It Matters

A NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote NFSv4.0 data server to cause client-side denial of service-crashing or busy-looping the mounting client-on systems running affected kernels from 4.12 up to fixed releases 6.18.52, 7.2.6, and 7.3-rc1. The issue is configuration-dependent, requiring pNFS flexfiles and a sessionless NFSv4.0 data server, and no public exploit was identified at time of analysis; vendor patches are available. Leadership should care because availability of NFS-dependent workloads could be disrupted, although there is no code execution or data exposure.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous, but the pNFS flexfiles v4.0-DS path is niche
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Nfs

View all
CVE-2026-90104 CRITICAL
9.8 Sep 17

A syntactically valid NFSv4.1 CB_SEQUENCE callback that carries an empty referring_call_list can leave an uninitialized

CVE-2026-90102 HIGH
7.5 Sep 17

NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client w
CVE-2026-90103 HIGH
7.5 Sep 17

Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent h
CVE-2026-90234 HIGH
7.5 Sep 17

Linux kernel NFSv4 clients can be driven into an endless state-recovery loop that leaves the mounting host unable to cle

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90149 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 ADVISORY https://vuldb.com/vuln/406671 REF https://git.kernel.org/stable/c/163c16e01f53fc8eb8d0f3484ae6c382265ecbbd REF https://git.kernel.org/stable/c/2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc REF https://git.kernel.org/stable/c/336b6da10021c69a8f273bbacdf7432fdc89a06f REF https://git.kernel.org/stable/c/436a214514e24103159aea455147d58b44a8a585 REF https://git.kernel.org/stable/c/5527af72b0100c94287bfec901b6313eeac567ca REF https://git.kernel.org/stable/c/e55d7fec8a9290f73032ee34c35dd68532809633

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy