CVE-2026-90149

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume

the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client

has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so

I/O to a v4.0 flexfiles DS oopses:

- nfs4_init_ds_session() dereferences clp->cl_session->session_state

while seeding the DS lease. It also only seeds cl_lease_time when

NFS4_SESSION_INITING is set; without a session that never happens, so

cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing

every 5 seconds. Seed the lease whenever there is no session and

return before touching session state.

- ff_layout_async_handle_error_v4() dereferences

clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the

v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References