NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-53391
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 12:16:50 UTC
Updated2026-07-20 15:16:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.001730000 probability, percentile 0.069380000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 76b94cbd32aacf36a641956385a852635c6802b9 git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 c8e4e0c701d0192a2efb6df059c0f9e19678c23d git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 427ab81a811dab4bca9d19f82eec5847ae42646e git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 012d37a568bfbb2c9686f03ade75560bc7139956 git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 30aae62e50b4e074a90a9a5e15246548fbdc1182 git Not specified
CNA Linux Linux affected 6b7f3cf96364eaf597940cb5c68a682894829915 41fe0f7b84f0cb822ae10ab08592996a592b2a25 git Not specified
CNA Linux Linux affected 4.0 Not specified
CNA Linux Linux unaffected 4.0 semver Not specified
CNA Linux Linux unaffected 5.15.211 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.177 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.144 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.95 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.38 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.3 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report