CVE-2026-53392

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: reject zero filehandle version count

fflayoutalloclseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzallocobjs(), and the current code only rejects NULL.

A zero count yields ZEROSIZEPTR, which can be stored in dssinfo->fhversions even though later flexfiles paths assume that at least one filehandle version exists.

Reject fhcount == 0 before the allocation, matching the existing zero versioncount validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:fflayoutencodefflayoutupdate.isra.0+0x15f/0x750 fflayoutencodelayoutreturn+0x683/0x970 nfs4xdrenclayoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.