CVE-2026-53391

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the Linux kernel within the NFSv4/pNFS implementation. The function nfs4 decode mp ds addr() decodes r netid and r addr opaques from a GETDEVICEINFO multipath-DS body using xdr stream decode string dup(). If the on-wire opaque has a length of zero, the decoder returns a NULL pointer. Because the code only checks if the length is less than zero, it proceeds to call strrchr() on the NULL pointer, leading to a kernel panic. This can be triggered by a pNFS-flexfile client connected to a malicious or compromised metadata server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.