CVE-2026-53392: Linux Kernel Flexfiles DoS Vulnerability

CVE-2026-53392 Overview

CVE-2026-53392 is a Linux kernel vulnerability in the NFSv4 flexfiles layout code. The function ff_layout_alloc_lseg() decodes a filehandle-version array count from the flexfiles layout body and passes it directly to kzalloc_objs(). The existing code rejects only NULL returns and fails to reject a zero count, which yields ZERO_SIZE_PTR. Later flexfiles code paths assume at least one filehandle version exists, leading to a null pointer dereference and kernel panic.

Critical Impact
A malformed flexfiles layout response from an NFSv4 server triggers a null pointer dereference in ff_layout_encode_ff_layoutupdate, causing a fatal kernel exception and denial of service on the NFS client.

Affected Products

Linux kernel (NFSv4/flexfiles layout driver)
NFS client hosts mounting NFSv4.1+ shares that negotiate the flexfiles layout type
Downstream distributions carrying the vulnerable NFS client code

Discovery Timeline

2026-07-19 - CVE-2026-53392 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-53392

Vulnerability Analysis

The vulnerability sits in the NFSv4 flexfiles pNFS layout decoder. When a client processes a LAYOUTGET response, ff_layout_alloc_lseg() parses the layout body and reads a filehandle-version array count (fh_count). This count is passed to kzalloc_objs() to allocate the fh_versions array. The allocation helper returns ZERO_SIZE_PTR (a special non-null sentinel) when asked to allocate zero objects. The current code only checks for NULL, so ZERO_SIZE_PTR is stored into dss_info->fh_versions.

Downstream flexfiles code paths, including ff_layout_encode_ff_layoutupdate() and ff_layout_encode_layoutreturn(), assume fh_versions[0] exists and dereference the pointer. Dereferencing ZERO_SIZE_PTR (0x10) triggers a null-page fault. A QEMU/KASAN reproduction confirmed a null-ptr-deref in range [0x0000000000000010-0x0000000000000017] followed by a kernel panic.

Root Cause

The defect is a missing input-validation check on attacker-controlled length fields decoded from an untrusted server response. The flexfiles GETDEVICEINFO parser already rejects a zero version_count, but the equivalent validation was absent from ff_layout_alloc_lseg() for fh_count. The patched kernel adds an explicit fh_count == 0 rejection before allocation, aligning both parsers.

Attack Vector

A malicious or compromised NFSv4 server crafts a flexfiles layout response with fh_count = 0. Any Linux client that mounts the export and issues a LAYOUTGET triggers the null pointer dereference during layout return encoding. The result is a fatal kernel exception on the client. Because the attack requires no client-side authentication beyond an existing NFS session and traverses the network, this represents a remote denial-of-service condition against Linux NFS clients.

See the upstream fix commits including Kernel Git Commit 2c6bb3c and Kernel Git Commit eeabb90 for the exact validation added.

Detection Methods for CVE-2026-53392

Indicators of Compromise

Kernel oops or panic messages referencing ff_layout_encode_ff_layoutupdate, ff_layout_encode_layoutreturn, or nfs4_xdr_enc_layoutreturn in dmesg or /var/log/kern.log.
KASAN reports citing null-ptr-deref in the address range 0x0000000000000010-0x0000000000000017 on kernels with KASAN enabled.
Sudden loss of NFS client availability immediately after a LAYOUTGET exchange with an NFSv4.1+ server offering flexfiles layouts.

Detection Strategies

Monitor kernel logs for panic or BUG entries containing ff_layout_ symbol names and correlate with recent NFS mount activity.
Capture NFSv4 traffic with tcpdump or tshark and inspect LAYOUTGET responses for flexfiles layouts declaring a zero filehandle-version count.
Alert on unexpected NFS client reboots or kernel crash dumps on hosts that mount external NFSv4 shares.

Monitoring Recommendations

Forward kernel ring buffer and kdump artifacts to a central log platform and build detections for the flexfiles symbol stack trace.
Baseline the set of NFSv4 servers each client contacts and alert on new or untrusted server endpoints negotiating pNFS flexfiles layouts.
Track kernel package versions across the fleet to identify hosts still running pre-patch NFS client code.

How to Mitigate CVE-2026-53392

Immediate Actions Required

Apply the stable kernel updates that include the flexfiles fh_count == 0 validation on all Linux NFS clients.
Restrict NFSv4 mounts to trusted, authenticated servers and block outbound NFS traffic to untrusted networks at the firewall.
Prioritize patching hosts that mount NFSv4.1+ exports capable of negotiating pNFS flexfiles layouts.

Patch Information

The fix was merged across multiple stable branches. Reference commits: Kernel Git Commit 18cc6d5, Kernel Git Commit 2131ed6, Kernel Git Commit 2c6bb3c, Kernel Git Commit 7779c85, Kernel Git Commit 9033591, Kernel Git Commit be78297, Kernel Git Commit d8c90c7, and Kernel Git Commit eeabb90. Consume the fix through your distribution's kernel security updates.

Workarounds

Mount NFSv4 shares with -o nfsvers=4.0 to avoid negotiating pNFS layouts on hosts that cannot be immediately patched.
Disable the flexfiles layout driver by blacklisting the nfs_layout_flexfiles module where pNFS is not required.
Enforce network segmentation so that NFS clients can only reach vetted, internal file servers.

bash

# Temporarily prevent flexfiles layout negotiation until the kernel is patched
echo 'blacklist nfs_layout_flexfiles' | sudo tee /etc/modprobe.d/blacklist-flexfiles.conf
sudo rmmod nfs_layout_flexfiles 2>/dev/null || true

# Or force NFSv4.0 mounts (no pNFS) in /etc/fstab
# server:/export /mnt/nfs nfs4 vers=4.0,ro,hard,timeo=600 0 0