CVE-2026-90102

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFSv4/pnfs component where the nfs4 pnfs ds add() function keys the per-net data server cache solely on the multipath address set, and the nfs4 pnfs ds structure does not record the version. In scenarios using flexfiles, a single address may serve both NFSv3 and NFSv4. When two device IDs on one address have different ds versions[0].version values, they share a single nfs4 pnfs ds. The first mirror to connect pins the ds clp to its version, causing the second mirror to use incorrect rpc call ops for a version the connection does not support. This mismatch in sequence-slot handling leads to a NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.