CVE-2026-90149

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL dereference issue exists in the NFSv4/flexfiles component when interacting with NFSv4.0 data servers. The system incorrectly assumes that the data server client has a session, which is a characteristic of NFSv4.1+ but not NFSv4.0. This leads to system crashes (oopses) during I/O operations in two specific scenarios: the nfs4 init ds session() function dereferences clp->cl session->session state while seeding the data server lease, and the ff layout async handle error v4() function dereferences clp->cl session->fc slot table during I/O errors. Additionally, the absence of a session causes cl lease time to remain at 0, leading the nfs4 renew state() function to enter a busy-loop and requeue every 5 seconds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.