CVE-2026-53392

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NFSv4/flexfiles: reject zero filehandle version count<br /> <br /> ff_layout_alloc_lseg() decodes the filehandle-version array count<br /> from the flexfiles layout body. The value is used as the count for<br /> kzalloc_objs(), and the current code only rejects NULL.<br /> <br /> A zero count yields ZERO_SIZE_PTR, which can be stored in<br /> dss_info-&gt;fh_versions even though later flexfiles paths assume that at<br /> least one filehandle version exists.<br /> <br /> Reject fh_count == 0 before the allocation, matching the existing zero<br /> version_count validation in the flexfiles GETDEVICEINFO parser.<br /> <br /> A QEMU/KASAN run with a malformed flexfiles layout hit:<br /> <br /> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]<br /> RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750<br /> ff_layout_encode_layoutreturn+0x683/0x970<br /> nfs4_xdr_enc_layoutreturn+0x278/0x3a0<br /> Kernel panic - not syncing: Fatal exception<br /> <br /> The patched kernel rejects the malformed layout without KASAN/oops/panic,<br /> and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.