Nfs
Monthly
Linux kernel NFSv4 clients can be driven into an endless state-recovery loop that leaves the mounting host unable to clear a revoked-delegation condition, degrading or stalling NFSv4 service on that host. The defect sits in the client-side delegation-recording path: three error flows in nfs_inode_set_delegation() return without sending the DELEGRETURN that RFC 8881 Section 20.2.4 requires, so the server still believes the client holds a delegation the client has already discarded. Reachability depends on a delegation recall for one opener racing a concurrent re-open that the server answers with a fresh write delegation; the assessed vector (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) frames this as a high-complexity, unauthenticated availability issue affecting the client rather than a memory-corruption or information-disclosure bug, and no public exploit code was identified at time of analysis (the issue is not in CISA KEV).
NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote party - specifically an NFSv4.0 data server referenced by a flexfiles layout - to crash the mounting client or drive its DS lease-renewal path into a busy-loop, yielding client-side denial of service (assessed AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) with no code execution and no data exposure. The defect affects kernels from 4.12 up to the fixed releases 6.18.52, 7.2.6 and 7.3-rc1, but is reachable only where the client kernel is built and configured for pNFS with the flexfiles layout driver and the served layout points at a sessionless NFSv4.0 data server; NFSv4.1+ data servers carry a session and are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor's 7.5 (AC:L) score overstates practical reachability given the configuration prerequisites reflected in the AC:H assessment.
A syntactically valid NFSv4.1 CB_SEQUENCE callback that carries an empty referring_call_list can leave an uninitialized pointer in the Linux kernel NFS client's callback decoder, which is later passed to kfree() and can crash the kernel (denial of service) on hosts that mount NFSv4.1 exports. The victim must be acting as an NFSv4.1 client and the trigger must originate from the server side, so an attacker must operate a malicious NFSv4.1 server or man-in-the-middle/compromise a server the victim already mounts from; the outcome also depends on nondeterministic slab contents, so a reliable crash is not guaranteed. The CVSS vector shows PR:N (unauthenticated reachability), but our assessment rates this AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability-only impact - and the vendor CNA's published 9.8 is a routine auto-maximum that overstates real-world risk. No public exploit was identified at time of analysis, and the kernel tag 'Information Disclosure' does not match the assessed availability-only impact.
Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent hang by a malicious or compromised NFS server, which returns maximally sized filehandles and network addresses through LAYOUTGET and GETDEVICEINFO so that the LAYOUTSTATS layoutupdate4 record exceeds the encoder's 256-byte reservation. When xdr_reserve_space() then returns NULL inside ff_layout_encode_io_latency(), the code path unwinds with dss_info->mirror->lock still held, leaving the lock permanently locked and hanging the client - a pure availability/denial-of-service condition with no code execution or data disclosure (C:N/I:N/A:H, vendor CVSS 3.1 7.5; our independent assessment rates the same impact but with AC:H rather than AC:L, since a hostile server, a mount relationship, and active flexfiles pNFS usage are all required). No public exploit code was identified and there is no CISA KEV entry at time of analysis; vendor-patched kernel releases are available.
NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client when it mounts a pNFS filesystem served by the flexfiles layout driver and connects to a server whose GETDEVICEINFO response returns two deviceids sharing one multipath data-server address but advertising different major NFS versions. The cache in nfs4_pnfs_ds_add() is keyed only on the address set, so the two mirrors alias to a single nfs4_pnfs_ds; whichever mirror connects first pins the client to its own NFS version, and the second mirror is then handed that client and selects rpc_call_ops for a protocol version the connection does not speak, causing mismatched sequence-slot handling and a kernel oops. The flaw is availability-only (no confidentiality or integrity impact), affects only hosts acting as NFS clients that mount pNFS with the flexfiles layout (CONFIG_NFS_V4_1), and there is no public exploit identified at time of analysis; exploitation requires the uncommon condition of mixed-version mirrors on a single data-server address, which is why our independent assessment raises attack complexity to AC:H relative to the vendor vector's AC:L.
Linux kernel NFSv4 clients can be driven into an endless state-recovery loop that leaves the mounting host unable to clear a revoked-delegation condition, degrading or stalling NFSv4 service on that host. The defect sits in the client-side delegation-recording path: three error flows in nfs_inode_set_delegation() return without sending the DELEGRETURN that RFC 8881 Section 20.2.4 requires, so the server still believes the client holds a delegation the client has already discarded. Reachability depends on a delegation recall for one opener racing a concurrent re-open that the server answers with a fresh write delegation; the assessed vector (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) frames this as a high-complexity, unauthenticated availability issue affecting the client rather than a memory-corruption or information-disclosure bug, and no public exploit code was identified at time of analysis (the issue is not in CISA KEV).
NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote party - specifically an NFSv4.0 data server referenced by a flexfiles layout - to crash the mounting client or drive its DS lease-renewal path into a busy-loop, yielding client-side denial of service (assessed AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) with no code execution and no data exposure. The defect affects kernels from 4.12 up to the fixed releases 6.18.52, 7.2.6 and 7.3-rc1, but is reachable only where the client kernel is built and configured for pNFS with the flexfiles layout driver and the served layout points at a sessionless NFSv4.0 data server; NFSv4.1+ data servers carry a session and are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor's 7.5 (AC:L) score overstates practical reachability given the configuration prerequisites reflected in the AC:H assessment.
A syntactically valid NFSv4.1 CB_SEQUENCE callback that carries an empty referring_call_list can leave an uninitialized pointer in the Linux kernel NFS client's callback decoder, which is later passed to kfree() and can crash the kernel (denial of service) on hosts that mount NFSv4.1 exports. The victim must be acting as an NFSv4.1 client and the trigger must originate from the server side, so an attacker must operate a malicious NFSv4.1 server or man-in-the-middle/compromise a server the victim already mounts from; the outcome also depends on nondeterministic slab contents, so a reliable crash is not guaranteed. The CVSS vector shows PR:N (unauthenticated reachability), but our assessment rates this AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability-only impact - and the vendor CNA's published 9.8 is a routine auto-maximum that overstates real-world risk. No public exploit was identified at time of analysis, and the kernel tag 'Information Disclosure' does not match the assessed availability-only impact.
Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent hang by a malicious or compromised NFS server, which returns maximally sized filehandles and network addresses through LAYOUTGET and GETDEVICEINFO so that the LAYOUTSTATS layoutupdate4 record exceeds the encoder's 256-byte reservation. When xdr_reserve_space() then returns NULL inside ff_layout_encode_io_latency(), the code path unwinds with dss_info->mirror->lock still held, leaving the lock permanently locked and hanging the client - a pure availability/denial-of-service condition with no code execution or data disclosure (C:N/I:N/A:H, vendor CVSS 3.1 7.5; our independent assessment rates the same impact but with AC:H rather than AC:L, since a hostile server, a mount relationship, and active flexfiles pNFS usage are all required). No public exploit code was identified and there is no CISA KEV entry at time of analysis; vendor-patched kernel releases are available.
NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client when it mounts a pNFS filesystem served by the flexfiles layout driver and connects to a server whose GETDEVICEINFO response returns two deviceids sharing one multipath data-server address but advertising different major NFS versions. The cache in nfs4_pnfs_ds_add() is keyed only on the address set, so the two mirrors alias to a single nfs4_pnfs_ds; whichever mirror connects first pins the client to its own NFS version, and the second mirror is then handed that client and selects rpc_call_ops for a protocol version the connection does not speak, causing mismatched sequence-slot handling and a kernel oops. The flaw is availability-only (no confidentiality or integrity impact), affects only hosts acting as NFS clients that mount pNFS with the flexfiles layout (CONFIG_NFS_V4_1), and there is no public exploit identified at time of analysis; exploitation requires the uncommon condition of mixed-version mirrors on a single data-server address, which is why our independent assessment raises attack complexity to AC:H relative to the vendor vector's AC:L.