Junglewise Threat Intelligence

CVE-2026-53391: Linux Kernel NULL pointer dereference in NFSv4 pNFS client

CVE-2026-53391 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NFSv4 implementation could allow a malicious or compromised storage server to crash a connected client computer. This occurs when the server sends a specifically malformed network address that the client fails to process safely, leading to a system 'panic' or crash. This could disrupt business operations by causing unexpected downtime for servers or workstations using pNFS storage.

Technical details

A NULL pointer dereference exists in the nfs4_decode_mp_ds_addr() function within fs/nfs/pnfs_nfs.c. The function uses xdr_stream_decode_string_dup() to decode r_netid and r_addr opaques but only checks if the returned length is less than zero. If a zero-length opaque is provided on the wire, the function returns 0 while leaving the buffer pointer as NULL. Subsequent calls to strrchr() on this NULL pointer cause a kernel panic. This is reachable by any pNFS-flexfile client mounted against a malicious or compromised metadata server. The fix updates the validation logic to reject zero-length strings with -EBADMSG.

Affected products

  • Linux Linux Kernel 6b7f3cf96364 to 76b94cbd32aa, c8e4e0c701d0, 6c344fff2fef, 427ab81a811d, 012d37a568bf, 30aae62e50b4, 41fe0f7b84f0

Timeline

  • 2026-05-27: other: Vulnerability fixed in source code
  • 2026-07-19: disclosed: CVE published

References