Executive brief
The Linux kernel's NFSv4 network file system client contains a NULL pointer dereference bug in the flexfiles layout driver when handling NFSv4.0 data servers. Attackers with network access to trigger file I/O operations on NFSv4.0 flexfiles data servers can crash the kernel, causing a denial of service to systems relying on NFS storage.
Technical details
The vulnerability exists in two code paths within the NFSv4 flexfiles implementation that incorrectly assume a data server client always has a session object (clp->cl_session). NFSv4.0 clients lack sessions and instead use clp->cl_slot_tbl; dereferencing the NULL cl_session pointer causes kernel oops. The first issue is in nfs4_init_ds_session() which dereferences clp->cl_session->session_state when seeding the DS lease. The second is in ff_layout_async_handle_error_v4() which dereferences clp->cl_session->fc_slot_table on every DS I/O error. The fix adds NULL checks and falls back to the v4.0 transport slot table when no session exists. Attack requires network connectivity to a vulnerable NFS client and ability to trigger file I/O operations against NFSv4.0 flexfiles data servers.
Affected products
- Linux Linux kernel Multiple versions (see commit 2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-08-17: patched: Upstream fix committed by Trond Myklebust
- 2026-07-08: other: Patch authored by Jeuk Kim