Executive brief
A vulnerability in the Linux kernel's NFSv4 implementation could allow a malicious or compromised storage server to crash a connected client computer. This occurs when the server sends a specifically malformed network address that the client fails to process safely, leading to a system 'panic' or crash. This could disrupt business operations by causing unexpected downtime for servers or workstations using pNFS storage.
Technical details
A NULL pointer dereference exists in the nfs4_decode_mp_ds_addr() function within fs/nfs/pnfs_nfs.c. The function uses xdr_stream_decode_string_dup() to decode r_netid and r_addr opaques but only checks if the returned length is less than zero. If a zero-length opaque is provided on the wire, the function returns 0 while leaving the buffer pointer as NULL. Subsequent calls to strrchr() on this NULL pointer cause a kernel panic. This is reachable by any pNFS-flexfile client mounted against a malicious or compromised metadata server. The fix updates the validation logic to reject zero-length strings with -EBADMSG.
Affected products
- Linux Linux Kernel 6b7f3cf96364 to 76b94cbd32aa, c8e4e0c701d0, 6c344fff2fef, 427ab81a811d, 012d37a568bf, 30aae62e50b4, 41fe0f7b84f0
Timeline
- 2026-05-27: other: Vulnerability fixed in source code
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956
- https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182
- https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25
- https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e
- https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea
- https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9
- https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d