The vulnerability in the Linux kernel's NFSv4/pNFS subsystem arises from the function nfs4_decode_mp_ds_addr failing to properly handle zero-length r_addr opaque fields. Specifically, the function uses xdr_stream_decode_string_dup() to decode address strings but only checks for negative length values before dereferencing the pointer. When the opaque field length is zero, the pointer is NULL, leading to a NULL pointer dereference at strrchr(NULL, '.') and causing a kernel panic. This can be triggered by any pNFS-flexfile client mounted against a malicious or compromised metadata server. The fix involves explicitly rejecting zero-length opaque address fields, causing the decoder to fail gracefully with an -EBADMSG error instead of panicking.

This vulnerability can cause a denial of service via a kernel panic on affected Linux systems running pNFS-flexfile clients. It requires interaction with a malicious or compromised metadata server to trigger the NULL pointer dereference. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to explicitly reject zero-length opaque address fields in the nfs4_decode_mp_ds_addr function, preventing the NULL pointer dereference. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.