224 lines
12 KiB
JSON
224 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-90149",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.789Z",
|
|
"datePublished": "2026-09-17T16:06:43.671Z",
|
|
"dateUpdated": "2026-10-30T12:34:23.855Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:34:23.855Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers\n\nflexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume\nthe data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client\nhas no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so\nI/O to a v4.0 flexfiles DS oopses:\n\n - nfs4_init_ds_session() dereferences clp->cl_session->session_state\n while seeding the DS lease. It also only seeds cl_lease_time when\n NFS4_SESSION_INITING is set; without a session that never happens, so\n cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing\n every 5 seconds. Seed the lease whenever there is no session and\n return before touching session state.\n\n - ff_layout_async_handle_error_v4() dereferences\n clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the\n v4.0 transport slot table (clp->cl_slot_tbl) when there is no session."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - A malicious NFSv4.1 MDS sets version=4 and minor_version=0 in the flexfiles GETDEVICEINFO device-addr body; nfs4_ff_alloc_deviceid_node() accepts that pair, nfs4_set_ds_client() builds a session-less v4.0 nfs_client, and nfs4_init_ds_session() then crashes on DS connect. GETDEVICEINFO is NFS/RPC over TCP.\nAC:L - nfs4_ff_alloc_deviceid_node() explicitly allows an NFSv4.0 DS (version==4 && minor_version<3). The MDS sets those two GETDEVICEINFO XDR words, and the next read/write that reaches nfs4_ff_layout_prepare_ds() → nfs4_init_ds_session() dereferences the NULL cl_session with no race.\nPR:N - The attacker is the remote MDS (or an on-path injector of GETDEVICEINFO replies) and needs no account or capability on the victim client; the client authenticates to the server, not the reverse.\nUI:N - On an already-mounted pNFS flexfiles share, ordinary file I/O drives LAYOUTGET then GETDEVICEINFO; the MDS can return a v4.0 DS in that GETDEVICEINFO and nfs4_init_ds_session() oopses with no further victim action such as mounting a new image.\nS:U - The NULL dereference oopses the NFS client kernel itself and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - nfs4_init_ds_session() loads clp->cl_session->session_state when cl_session is NULL, a pure NULL-pointer fault at a low offset of struct nfs4_session, with no out-of-bounds read or other disclosure.\nI:N - The same NULL load of cl_session (and cl_session->fc_slot_table in ff_layout_async_handle_error_v4) faults before any store; this is not a UAF, overflow, or type confusion that could yield a write primitive.\nA:H - Dereferencing the NULL cl_session in nfs4_init_ds_session() on DS connect, or cl_session->fc_slot_table in ff_layout_async_handle_error_v4 on a DS I/O error, produces a kernel oops that takes down the client."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/flexfilelayout/flexfilelayout.c",
|
|
"fs/nfs/nfs4session.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "e55d7fec8a9290f73032ee34c35dd68532809633",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "336b6da10021c69a8f273bbacdf7432fdc89a06f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "5527af72b0100c94287bfec901b6313eeac567ca",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "163c16e01f53fc8eb8d0f3484ae6c382265ecbbd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "436a214514e24103159aea455147d58b44a8a585",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
|
|
"lessThan": "2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/flexfilelayout/flexfilelayout.c",
|
|
"fs/nfs/nfs4session.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.12",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.12",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.114",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.52",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.6",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "6.12.114"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "6.18.52"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "7.2.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.12",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e55d7fec8a9290f73032ee34c35dd68532809633"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/336b6da10021c69a8f273bbacdf7432fdc89a06f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5527af72b0100c94287bfec901b6313eeac567ca"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/163c16e01f53fc8eb8d0f3484ae6c382265ecbbd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/436a214514e24103159aea455147d58b44a8a585"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc"
|
|
}
|
|
],
|
|
"title": "NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |