CVE-2026-53391

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a

netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately

calls strrchr(buf, '.') to locate the port separator. Both decodes

use xdr_stream_decode_string_dup(), and the current code checks only

"nlen < 0" / "rlen < 0" before dereferencing the returned string.

When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()

returns 0 and xdr_stream_decode_string_dup() falls through to its

"*str = NULL; return ret" tail, leaving buf NULL with a return value

of 0. The "< 0" check does not catch this, and the next line is

strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from

any pNFS-flexfile client mounted against a malicious or compromised

metadata server.

Reject the zero-length cases explicitly so the decoder fails with

-EBADMSG (treated as a malformed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References