CVE-2026-53391 - Vulnerability Details

- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a
netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately
calls strrchr(buf, '.') to locate the port separator. Both decodes
use xdr_stream_decode_string_dup(), and the current code checks only
"nlen < 0" / "rlen < 0" before dereferencing the returned string.

When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()
returns 0 and xdr_stream_decode_string_dup() falls through to its
"*str = NULL; return ret" tail, leaving buf NULL with a return value
of 0. The "< 0" check does not catch this, and the next line is
strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from
any pNFS-flexfile client mounted against a malicious or compromised
metadata server.

Reject the zero-length cases explicitly so the decoder fails with
-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of
panicking the client.

Published: 2026-07-19

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the NFSv4/pNFS client decoder allows a malicious or compromised metadata server to send a GETDEVICEINFO request containing a zero‑length address opaque. The decoder then dereferences a NULL pointer, resulting in a kernel panic. The vulnerability does not provide code execution but can be used to disrupt the NFS client by repeatedly triggering the crash when the client processes the malformed request.

Affected Systems

All Linux kernel releases that implement NFSv4/pNFS are affected, as the issue resides in the core kernel code handling the client‑side decoding. No specific version was listed, so any deployment using the NFS client on a kernel that has not applied the patch is vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1% shows a low likelihood that this vulnerability is actively exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited exploitation. Based on the description, it is inferred that the likely attack vector involves a malicious or compromised metadata server that sends a malformed GETDEVICEINFO response to an NFS client.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 76b94cbd32aacf36a641956385a852635c6802b9
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< c8e4e0c701d0192a2efb6df059c0f9e19678c23d
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 427ab81a811dab4bca9d19f82eec5847ae42646e
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 012d37a568bfbb2c9686f03ade75560bc7139956
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 30aae62e50b4e074a90a9a5e15246548fbdc1182
`6b7f3cf96364eaf597940cb5c68a682894829915`	affected	< 41fe0f7b84f0cb822ae10ab08592996a592b2a25

Linux

affected

Version	Status	Constraints
`4.0`	affected	—
`0`	unaffected	< 4.0
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6b7f3cf96364eaf597940cb5c68a682894829915,76b94cbd32aacf36a641956385a852635c6802b9)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,c8e4e0c701d0192a2efb6df059c0f9e19678c23d)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,427ab81a811dab4bca9d19f82eec5847ae42646e)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,012d37a568bfbb2c9686f03ade75560bc7139956)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,30aae62e50b4e074a90a9a5e15246548fbdc1182)`	affected	code_commit	—
`[6b7f3cf96364eaf597940cb5c68a682894829915,41fe0f7b84f0cb822ae10ab08592996a592b2a25)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.0`	affected	generic	—
`[0,4.0)`	unaffected	generic	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update your Linux kernel to a release that contains the NFSv4/pNFS decoder fix and install the package update as soon as it becomes available.
After updating the kernel, restart the affected nodes so the patch takes effect due to the nature of a kernel module vulnerability.
Implement network hardening by ensuring that NFS clients communicate only with trusted metadata servers; restrict access to the NFS service to controlled subnet ranges to reduce the chance of a malicious server sending the malformed request.

Generated by OpenCVE AI on July 30, 2026 at 22:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00517.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956
https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182
https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25
https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e
https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea
https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9
https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d
https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-53391-d4df@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53391
https://www.cve.org/CVERecord?id=CVE-2026-53391

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-53391-d4df@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53391 https://www.cve.org/CVERecord?id=CVE-2026-53391
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.
Title		NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956 https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182 https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25 https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9 https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:01:55.521Z

Updated: 2026-08-05T12:35:31.235Z

Reserved: 2026-06-09T07:44:35.402Z

Link: CVE-2026-53391

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53391 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object