The Linux kernel's NFSv4 flexfiles component had a vulnerability where ff_layout_alloc_lseg() accepted a zero filehandle version count, which led to the use of ZERO_SIZE_PTR in dss_info->fh_versions. This caused later code to assume at least one filehandle version existed, resulting in a null-pointer dereference and kernel panic when processing malformed flexfiles layouts. The patch adds validation to reject fh_count == 0 before allocation, aligning with existing checks in the flexfiles GETDEVICEINFO parser. Testing with QEMU/KASAN confirmed the issue caused fatal exceptions, which are prevented by the fix.

The vulnerability can cause a kernel panic due to null-pointer dereference when processing malformed NFSv4 flexfiles layouts with a zero filehandle version count. This leads to denial of service by crashing the kernel. There is no indication of code execution or data corruption beyond the crash. No known exploits are reported in the wild.

A patch has been applied to the Linux kernel to reject zero filehandle version counts before allocation, preventing the null-pointer dereference and kernel panic. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated in the provided data; check the vendor advisory for the exact fixed versions and update instructions.