In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4_pnfs_ds_add() keys… (CVE-2026-90102)
A vulnerability in the Linux kernel's NFSv4/pnfs implementation was resolved. The issue involved the data server cache keying mechanism in nfs4_pnfs_ds_add(), which keyed the cache only on the multipath address set without considering the NFS version. This caused different device IDs sharing the same address but using different NFS versions to incorrectly share a single cache entry, leading to a NULL pointer dereference. The fix added the NFS major version to the cache key, preventing aliasing and ensuring separate connections for different versions.
AI Analysis
Technical Summary
The Linux kernel's NFSv4/pnfs data server cache keyed entries solely on the multipath address set, ignoring the NFS version. This was sufficient for the files layout driver, which always uses NFSv4, but problematic for flexfiles, which can use both NFSv3 and NFSv4 on the same address. Consequently, two device IDs with different NFS versions shared a single cache entry, causing the client to select RPC operations for a version it did not support. This mismatch led to a NULL pointer dereference due to improper sequence-slot handling. The vulnerability was fixed by including the NFS major version in the cache key, allowing separate cache entries and connections per version, maintaining compatibility for v4.0 and v4.1.
Potential Impact
This vulnerability can cause a NULL pointer dereference in the Linux kernel's NFS client code, resulting in a denial of service (kernel crash). There is no indication of confidentiality or integrity impact. The CVSS score of 7.5 reflects a high severity denial of service vulnerability exploitable remotely without privileges or user interaction.
Mitigation Recommendations
A fix is available and has been applied to the Linux kernel. Users should update to a kernel version that includes this patch to prevent the NULL pointer dereference issue. No additional mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4_pnfs_ds_add() keys… (CVE-2026-90102)
Description
A vulnerability in the Linux kernel's NFSv4/pnfs implementation was resolved. The issue involved the data server cache keying mechanism in nfs4_pnfs_ds_add(), which keyed the cache only on the multipath address set without considering the NFS version. This caused different device IDs sharing the same address but using different NFS versions to incorrectly share a single cache entry, leading to a NULL pointer dereference. The fix added the NFS major version to the cache key, preventing aliasing and ensuring separate connections for different versions.
CVSS v3.1
Score 7.5high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's NFSv4/pnfs data server cache keyed entries solely on the multipath address set, ignoring the NFS version. This was sufficient for the files layout driver, which always uses NFSv4, but problematic for flexfiles, which can use both NFSv3 and NFSv4 on the same address. Consequently, two device IDs with different NFS versions shared a single cache entry, causing the client to select RPC operations for a version it did not support. This mismatch led to a NULL pointer dereference due to improper sequence-slot handling. The vulnerability was fixed by including the NFS major version in the cache key, allowing separate cache entries and connections per version, maintaining compatibility for v4.0 and v4.1.
Potential Impact
This vulnerability can cause a NULL pointer dereference in the Linux kernel's NFS client code, resulting in a denial of service (kernel crash). There is no indication of confidentiality or integrity impact. The CVSS score of 7.5 reflects a high severity denial of service vulnerability exploitable remotely without privileges or user interaction.
Mitigation Recommendations
A fix is available and has been applied to the Linux kernel. Users should update to a kernel version that includes this patch to prevent the NULL pointer dereference issue. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wj5v-2g3c-hmrh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90102"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade52755bf5e2cf5edc1c3
Added to database: 09/19/2026, 01:28:07 UTC
Last enriched: 09/19/2026, 01:54:24 UTC
Last updated: 09/19/2026, 03:04:05 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.