CVE-2026-53392

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: reject zero filehandle version count

ff_layout_alloc_lseg() decodes the filehandle-version array count

from the flexfiles layout body. The value is used as the count for

kzalloc_objs(), and the current code only rejects NULL.

A zero count yields ZERO_SIZE_PTR, which can be stored in

dss_info->fh_versions even though later flexfiles paths assume that at

least one filehandle version exists.

Reject fh_count == 0 before the allocation, matching the existing zero

version_count validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]

RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750

ff_layout_encode_layoutreturn+0x683/0x970

nfs4_xdr_enc_layoutreturn+0x278/0x3a0

Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References