CVE-2026-53392
published 2026-07-19CVE-2026-53392: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
40.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
ff_layout_encode_layoutreturn+0x683/0x970
nfs4_xdr_enc_layoutreturn+0x278/0x3a0
Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic,
and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < 9033591535c066726f5b505126ccb4068b98fa4f | 9033591535c066726f5b505126ccb4068b98fa4f |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf | 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < be7829715e341b42846437dd9e721005db59f0cc | be7829715e341b42846437dd9e721005db59f0cc |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < eeabb9020721db6bc132e68eeae380b8d4fb4b04 | eeabb9020721db6bc132e68eeae380b8d4fb4b04 |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < 7779c85028a0676fb190cde4f0c540f4f8e97761 | 7779c85028a0676fb190cde4f0c540f4f8e97761 |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < d8c90c7cc061265d5f2813a1f5c82ef2f4707e67 | d8c90c7cc061265d5f2813a1f5c82ef2f4707e67 |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < 2131ed64b767ffa8bcdb3677d90f3964e39aabc8 | 2131ed64b767ffa8bcdb3677d90f3964e39aabc8 |
| linux | linux | >= d67ae825a59d639e4d8b82413af84d854617a87e < 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 | 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.0 < 5.10.261 | 5.10.261 |
| linux | linux_kernel | >= 5.11 < 5.15.212 | 5.15.212 |
| linux | linux_kernel | >= 5.16 < 6.1.178 | 6.1.178 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.145 | 6.6.145 |
| linux | linux_kernel | >= 6.7 < 6.12.96 | 6.12.96 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: NFSv4/flexfiles: reject zero filehandle version count
vendor_redhat·2026-07-19·CVSS 7.5
CVE-2026-53392 [HIGH] CWE-476 kernel: NFSv4/flexfiles: reject zero filehandle version count
kernel: NFSv4/flexfiles: reject zero filehandle version count
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017
GHSA
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the f
ghsa_unreviewed·2026-07-19
CVE-2026-53392 [HIGH] In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the f
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cfhttps://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4fhttps://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cchttps://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04
2026-07-19
Published