The Linux kernel's NFSv4 flexfiles code in ff_layout_alloc_lseg() incorrectly handled a zero filehandle version count. The function decodes the filehandle-version array count from the flexfiles layout body and uses it as the count for kzalloc_objs(). Previously, only NULL counts were rejected, but zero counts yielded ZERO_SIZE_PTR, which was stored and later assumed to represent at least one filehandle version. This caused a null pointer dereference and kernel panic when processing malformed flexfiles layouts. The patch adds validation to reject fh_count == 0 before allocation, aligning with existing validation in the flexfiles GETDEVICEINFO parser. The fix prevents KASAN/oops/panic conditions while maintaining normal operation for valid counts.

The vulnerability can cause a kernel panic due to a null pointer dereference when processing malformed NFSv4 flexfiles layouts with a zero filehandle version count. This results in a denial of service (DoS) condition. There is no indication of confidentiality or integrity impact. The CVSS score is 7.5 with a vector indicating network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A patch has been applied to the Linux kernel that rejects malformed flexfiles layouts with a zero filehandle version count, preventing kernel panics. Users should update to the fixed kernel version once available. Since this is a kernel vulnerability, applying the official kernel update from the Linux distribution vendor or kernel maintainers is the recommended remediation. No additional mitigations are indicated.