AZL-92540
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92540.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-92540
- Upstream
- Published
- 2026-07-19T12:16:50Z
- Modified
- 2026-08-28T17:47:39.195174264Z
- Summary
- CVE-2026-53392 affecting package kernel for versions less than 6.6.145.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
fflayoutalloclseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzallocobjs(), and the current code only rejects NULL.
A zero count yields ZEROSIZEPTR, which can be stored in dssinfo->fhversions even though later flexfiles paths assume that at least one filehandle version exists.
Reject fhcount == 0 before the allocation, matching the existing zero versioncount validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:fflayoutencodefflayoutupdate.isra.0+0x15f/0x750 fflayoutencodelayoutreturn+0x683/0x970 nfs4xdrenclayoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
- References