High 7.5Published Sep 17, 2026

CVE-2026-90149NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

Updated under an hour ago (2026-10-19 06:50 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses: - nfs4_init_ds_session() dereferences clp->cl_session->session_state while seeding the DS lease. It also only seeds cl_lease_time when NFS4_SESSION_INITING is set; without a session that never happens, so cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state. - ff_layout_async_handle_error_v4() dereferences clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a7878ca140084ec267ede48fce64d7e60f6d873e before 163c16e01f53fc8eb8d0f3484ae6c382265ecbbd; from a7878ca140084ec267ede48fce64d7e60f6d873e before 436a214514e24103159aea455147d58b44a8a585; from a7878ca140084ec267ede48fce64d7e60f6d873e before 2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc	CNA record

References

https://git.kernel.org/stable/c/163c16e01f53fc8eb8d0f3484ae6c382265ecbbd
https://git.kernel.org/stable/c/436a214514e24103159aea455147d58b44a8a585
https://git.kernel.org/stable/c/2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.