cbcvebase.
CVE-2026-53392
published 2026-07-19

CVE-2026-53392: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the…

PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
40.2th percentile
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

Affected

17 ranges
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < 9033591535c066726f5b505126ccb4068b98fa4f9033591535c066726f5b505126ccb4068b98fa4f
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf18cc6d57a14fa65ab2a2b52279f549041c4bc9cf
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < be7829715e341b42846437dd9e721005db59f0ccbe7829715e341b42846437dd9e721005db59f0cc
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < eeabb9020721db6bc132e68eeae380b8d4fb4b04eeabb9020721db6bc132e68eeae380b8d4fb4b04
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < 7779c85028a0676fb190cde4f0c540f4f8e977617779c85028a0676fb190cde4f0c540f4f8e97761
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < d8c90c7cc061265d5f2813a1f5c82ef2f4707e67d8c90c7cc061265d5f2813a1f5c82ef2f4707e67
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < 2131ed64b767ffa8bcdb3677d90f3964e39aabc82131ed64b767ffa8bcdb3677d90f3964e39aabc8
linuxlinux>= d67ae825a59d639e4d8b82413af84d854617a87e < 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f22c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2
linuxlinux_kernel
linuxlinux_kernel>= 4.0 < 5.10.2615.10.261
linuxlinux_kernel>= 5.11 < 5.15.2125.15.212
linuxlinux_kernel>= 5.16 < 6.1.1786.1.178
linuxlinux_kernel>= 6.13 < 6.18.386.18.38
linuxlinux_kernel>= 6.19 < 7.1.37.1.3
linuxlinux_kernel>= 6.2 < 6.6.1456.6.145
linuxlinux_kernel>= 6.7 < 6.12.966.12.96

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.