CVE-2026-53392NFSv4/flexfiles: reject zero filehandle version count
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d67ae825a59d639e4d8b82413af84d854617a87e before 9033591535c066726f5b505126ccb4068b98fa4f; from d67ae825a59d639e4d8b82413af84d854617a87e before 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf; from d67ae825a59d639e4d8b82413af84d854617a87e before be7829715e341b42846437dd9e721005db59f0cc; from d67ae825a59d639e4d8b82413af84d854617a87e before eeabb9020721db6bc132e68eeae380b8d4fb4b04; from d67ae825a59d639e4d8b82413af84d854617a87e before 7779c85028a0676fb190cde4f0c540f4f8e97761; from d67ae825a59d639e4d8b82413af84d854617a87e before d8c90c7cc061265d5f2813a1f5c82ef2f4707e67; from d67ae825a59d639e4d8b82413af84d854617a87e before 2131ed64b767ffa8bcdb3677d90f3964e39aabc8; from d67ae825a59d639e4d8b82413af84d854617a87e before 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 | CNA record |
linux linux_kernel linux:linux_kernel | from 4.0 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.38; from 6.19 before 7.1.3 | NVD |
References
- https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4fpatch
- https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cfpatch
- https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0ccpatch
- https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04patch
- https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761patch
- https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67patch
- https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8patch
- https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.