Look up another CVE · open CVE-2026-90102 in the interactive tracker
CVE-2026-90102
NFSv4/pnfs: key the data server cache on the NFS version
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem fs/nfs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90102 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
nfs4_pnfs_ds_add() keys the per-net data server cache on the multipath address set alone, and struct nfs4_pnfs_ds records no version. That suffices for the files layout driver, which always connects with version 4, but flexfiles takes its version tuple from GETDEVICEINFO per device, and one address can legitimately serve both NFSv3 and NFSv4. Two deviceids on one address with different ds_versions[0].version therefore share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other one is handed that client anyway, so it selects rpc_call_ops for a version the connection does not speak, and the mismatched sequence-slot handling dereferences NULL. Add the version to the cache key so the two cannot alias, giving each version its own nfs4_pnfs_ds and connection while both mirrors stay usable. Only the major version is compared, since that is what selects rpc_call_ops and rpc_ops; v4.0 and v4.1 keep sharing a client. The files layout driver passes the 4 it already hardcodes at connect time.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/nfs/filelayout/filelayoutdev.c
fs/nfs/flexfilelayout/flexfilelayoutdev.c
fs/nfs/pnfs.h
fs/nfs/pnfs_nfs.c
- What this is
- NFS, SUNRPC, AND LOCKD CLIENTSMAINTAINERS section matched on fs/nfs/ · linux-nfs@vger.kernel.org · Maintained
- Kernel module
- nfs_layout_nfsv41_files
Check it on the machine
grep -wE 'CONFIG_NFS_FS|CONFIG_PNFS_FILE_LAYOUT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nfs_layout_nfsv41_filesPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NFS_FS, CONFIG_PNFS_FILE_LAYOUT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.70%, higher than 52.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/nfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.0 | 5.10.270 | ffb100b0da0e |
| 4.0 | 5.15.221 | 02e160922bc8 |
| 4.0 | 6.1.188 | bc7aa9d8aff8 |
| 4.0 | 6.6.157 | dd5bd091daa4 |
| 4.0 | 6.12.110 | f2994ba1263d |
| 4.0 | 6.18.52 | 27f640cd92ee |
| 4.0 | 7.2.6 | bbc975cfb07a |
| 4.0 | 7.3 | 13c23c5cb977 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The colliding cache key is carried in the MDS GETDEVICEINFO reply: nfs4_ff_alloc_deviceid_node() XDR-decodes the flexfiles device_addr4 multipath r_addr list and ds_versions[0].version, then nfs4_pnfs_ds_add() indexed nfs4_data_server_cache on addresses alone so two deviceids with the same address and versions 3 vs 4 alias. That COMPOUND arrives over NFSv4.1/TCP.
- AC:LAttack complexity, low
- The MDS chooses LAYOUTGET mirrors and both GETDEVICEINFO bodies. ff_layout_pg_init_write() calls nfs4_ff_layout_prepare_ds() per mirror; the first nfs4_pnfs_ds_connect() pins ds_clp to NFSv3 (nfs3_set_ds_client), and the later ff_layout_write_pagelist() uses ff_layout_write_call_ops_v4 on that client with no race.
- PR:NPrivileges required, none
- The attacker is the remote flexfiles MDS (or an injector of GETDEVICEINFO/LAYOUTGET RPC replies) and holds no account or capability on the victim; nfs4_proc_getdeviceinfo() consumes those replies on the client's existing session.
- UI:NUser interaction, none
- Flexfiles sets PNFS_LAYOUTGET_ON_OPEN, so an already-mounted pNFS export issues LAYOUTGET at open; the next write through ff_layout_pg_init_write() fetches both deviceids and hits the aliased ds_clp without any extra victim step beyond ordinary file I/O.
- S:UScope, unchanged
- The oops is in the client's nfs4_setup_sequence() on the aliased nfs4_pnfs_ds during DS I/O for that mount; it does not cross a VM, IOMMU, or sandbox boundary.
- C:NConfidentiality impact, none
- ff_layout_write_prepare_v4()/ff_layout_read_prepare_v4() call nfs4_setup_sequence() on the v3 ds_clp, which does spin_lock(&tbl->slot_tbl_lock) with tbl = client->cl_slot_tbl (NULL on nfs_init_client); that is a NULL dereference with no OOB read or UAF.
- I:NIntegrity impact, none
- The version-mismatched rpc_call_ops path never writes through a corrupted object or hijacks control flow: nfs4_setup_sequence() NULL-dereferences the v3 client's cl_slot_tbl before any slot table or session state is modified.
- A:HAvailability impact, high
- nfs4_setup_sequence() NULL-dereferences cl_slot_tbl in process context on the v4 DS write/read that reused the v3-pinned ds_clp, causing a kernel oops/panic of the NFS client.