SECUFOCUSNOW
Home›CVE index›CVE-2026-53392
Review reviewHigh

CVE-2026-53392

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVI...

CVSS
7.5
EPSS
0.50%
40.0% percentile
CISA KEV
Not listed
Published
2026.07.19
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.50%
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVI...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= d67ae825a59d639e4d8b82413af84d854617a87e < 9033591535c066726f5b505126ccb4068b98fa4f, >= d67ae825a59d639e4d8b82413af84d854617a87e < 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf, >= d67ae825a59d639e4d8b82413af84d854617a87e < be7829715e341b42846437dd9e721005db59f0cc, >= d67ae825a59d639e4d8b82413af84d854617a87e < eeabb9020721db6bc132e68eeae380b8d4fb4b04, >= d67ae825a59d639e4d8b82413af84d854617a87e < 7779c85028a0676fb190cde4f0c540f4f8e97761, >= d67ae825a59d639e4d8b82413af84d854617a87e < d8c90c7cc061265d5f2813a1f5c82ef2f4707e67, >= d67ae825a59d639e4d8b82413af84d854617a87e < 2131ed64b767ffa8bcdb3677d90f3964e39aabc8, >= d67ae825a59d639e4d8b82413af84d854617a87e < 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2, >= 4.0, >= 4.0 < 5.10.261, >= 5.11 < 5.15.212, >= 5.16 < 6.1.178, >= 6.2 < 6.6.145, >= 6.7 < 6.12.96, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3
Fixed versions
5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.38, 7.1.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-476