Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) implementation can cause a system crash (kernel oops). This occurs when the system incorrectly handles situations where a directory and a file share the same name during concurrent operations. An attacker or a malfunctioning application could trigger this flaw to disrupt system availability and cause a denial-of-service.
Technical details
A flaw exists in the NFSv3 client implementation within the Linux kernel's nfs3_proc_create function. When nfs3_do_create or nfs_add_or_obtain finds a directory alias via d_splice_alias, the function fails to return an error, leaving the original dentry in a negative state. Subsequent calls to nfs_atomic_open_v23 or finish_open then pass this negative dentry to do_dentry_open, triggering a kernel oops. This race condition is typically observed during concurrent file and directory creation/removal with the same name when O_EXCL is not used. The fix introduces an explicit d_is_dir() check to return EISDIR when a directory alias is found.
Affected products
- Linux Linux kernel 6.10 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-02-19: other: Patch authored
- 2026-05-08: disclosed: CVE assigned and published
- 2026-05-21: advisory: NVD analysis updated