CVE-2026-90149

CVE CVE-2026-90149EUVD EUVD-2026-81742Published 2026-09-17T16:06:43.000ZLast changed 2026-09-18T17:53:25.000ZCVSS 7.5

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses: - nfs4_init_ds_session() dereferences clp->cl_session->session_state while seeding the DS lease. It also only seeds cl_lease_time when NFS4_SESSION_INITING is set; without a session that never happens, so cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing every 5 seconds. Seed the lease whenever there is no session and return before touching session state. - ff_layout_async_handle_error_v4() dereferences clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 4.12; patch: 7.3-rc1; a7878ca140084ec267ede48fce64d7e60f6d873e <2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc; a7878ca140084ec267ede48fce64d7e60f6d873e <436a214514e24103159aea455147d58b44a8a585; patch: 7.2.6; patch: 0; a7878ca140084ec267ede48fce64d7e60f6d873e <163c16e01f53fc8eb8d0f3484ae6c382265ecbbd; patch: 6.18.52

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.