CVE-2026-90102 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use NFSv4/pnfs should be aware of this vulnerability and take steps to apply the patch and verify the NFS version used in their environment.

Why it matters

A vulnerability in the Linux kernel's NFSv4/pnfs implementation could allow an attacker to cause a denial of service. Linux kernel developers and administrators who use NFSv4/pnfs should be aware of this vulnerability and take steps to apply the patch and verify the NFS version used in their environment.

• Denial of service attacks may be possible
• Verification of NFS version is required
• Patch application is necessary to resolve the issue

Technical summary

The Linux kernel's NFSv4/pnfs implementation has a vulnerability that could allow an attacker to cause a denial of service. The issue arises from the data server cache being keyed on the multipath address set alone, without considering the NFS version. This can lead to a mismatch in sequence-slot handling, resulting in a NULL pointer dereference. The vulnerability is resolved by adding the version to the cache key.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Verify the NFS version used in the environment
• Monitor for potential denial of service attacks
• Perform a thorough review of the system configuration
• Conduct a risk assessment to identify potential vulnerabilities
• Implement additional security measures to prevent similar attacks
• Continuously monitor the system for suspicious activity

Evidence notes

The vulnerability is caused by the data server cache being keyed on the multipath address set alone, without considering the NFS version. This can lead to a mismatch in sequence-slot handling, resulting in a NULL pointer dereference. The issue is resolved by adding the version to the cache key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.