CVE-2026-53391
published 2026-07-19CVE-2026-53391: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr()…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.52%
41.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a
netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately
calls strrchr(buf, '.') to locate the port separator. Both decodes
use xdr_stream_decode_string_dup(), and the current code checks only
"nlen < 0" / "rlen < 0" before dereferencing the returned string.
When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()
returns 0 and xdr_stream_decode_string_dup() falls through to its
"*str = NULL; return ret" tail, leaving buf NULL with a return value
of 0. The "< 0" check does not catch this, and the next line is
strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from
any pNFS-flexfile client mounted against a malicious or compromised
metadata server.
Reject the zero-length cases explicitly so the decoder fails with
-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of
panicking the client.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 76b94cbd32aacf36a641956385a852635c6802b9 | 76b94cbd32aacf36a641956385a852635c6802b9 |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < c8e4e0c701d0192a2efb6df059c0f9e19678c23d | c8e4e0c701d0192a2efb6df059c0f9e19678c23d |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea | 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 427ab81a811dab4bca9d19f82eec5847ae42646e | 427ab81a811dab4bca9d19f82eec5847ae42646e |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 012d37a568bfbb2c9686f03ade75560bc7139956 | 012d37a568bfbb2c9686f03ade75560bc7139956 |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 30aae62e50b4e074a90a9a5e15246548fbdc1182 | 30aae62e50b4e074a90a9a5e15246548fbdc1182 |
| linux | linux | >= 6b7f3cf96364eaf597940cb5c68a682894829915 < 41fe0f7b84f0cb822ae10ab08592996a592b2a25 | 41fe0f7b84f0cb822ae10ab08592996a592b2a25 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.0 < 5.15.211 | 5.15.211 |
| linux | linux_kernel | >= 5.16 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of
ghsa_unreviewed·2026-07-19
CVE-2026-53391 [HIGH] In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a
netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately
calls strrchr(buf, '.') to locate the port separator. Both decodes
use xdr_stream_decode_string_dup(), and the current code checks only
"nlen < 0" / "rlen < 0" before dereferencing the returned string.
When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()
returns 0 and xdr_stream_decode_string_dup() falls through to its
"*str = NULL; return ret" tail, leaving buf NULL with a return value
of 0. The "< 0" check does not catch this, and the next line is
strrchr(NULL, '.'), a kernel NULL pointer dereference
Red Hat
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
vendor_redhat·2026-07-19·CVSS 7.5
CVE-2026-53391 [HIGH] CWE-476 kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a
netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately
calls strrchr(buf, '.') to locate the port separator. Both decodes
use xdr_stream_decode_string_dup(), and the current code checks only
"nlen < 0" / "rlen < 0" before dereferencing the returned string.
When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()
returns 0 and xdr_stream_decode_string_dup() falls through to its
"*str = NULL; return ret" tail, leaving buf NULL with a return value
of 0. The "< 0" check does not catch this, and t
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646ehttps://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5eahttps://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d
2026-07-19
Published