The Linux kernel's nfs4_decode_mp_ds_addr function decodes network address strings from a GETDEVICEINFO multipath-DS body. It uses xdr_stream_decode_string_dup() to decode r_netid and r_addr opaques but only checks for negative length values before dereferencing the returned string. When the opaque length is zero, the function returns a NULL pointer without error, leading to a subsequent strrchr(NULL, '.') call that triggers a kernel NULL pointer dereference. This vulnerability is reachable by any pNFS-flexfile client mounting from a malicious or compromised metadata server. The fix explicitly rejects zero-length r_addr values, causing the decoder to return -EBADMSG and preventing kernel panic.

Exploitation of this vulnerability results in a denial of service via kernel panic on affected Linux systems using pNFS-flexfile clients. There is no impact on confidentiality or integrity reported. The CVSS score is 7.5 (high impact on availability). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is applied, avoid mounting pNFS-flexfile clients from untrusted or potentially compromised metadata servers to mitigate risk.