CVE-2026-53392

Aliases:UBUNTU-CVE-2026-53392DEBIAN-CVE-2026-53392CGA-32gq-w8xx-3rwqCGA-4865-r75j-qmv8CGA-8wc2-mx49-fghcCGA-f9jm-c88j-99gwCGA-h8h8-7gh4-cr32
Advisory lineage Upstream: 0 Downstream: 26
Analyzed
Published: 19 Jul 2026, 12:01
Last modified:17 Aug 2026, 04:50

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.53% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jul 2026, 12:01
Published
Vulnerability first disclosed
17 Aug 2026, 04:50
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.53%• Percentile: 44%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • chainguard•linux-aws-6.12

    all

  • chainguard•linux-azure-6.12

    < 6.12.101-r0

  • chainguard•linux-gcp-6.12

    < 6.12.101-r0

  • chainguard•linux-qemu-6.12

    < 6.12.101-r0

  • chainguard•linux-vmware-6.12

    < 6.12.100-r0

  • debian•linux

    < 5.10.262-1 | < 6.1.180-1 | < 6.12.96-1 | < 7.1.3-1

  • debian•linux-6.1

    < 6.1.180-1~deb11u1

  • debian•linux-6.12

    < 6.12.100-1~deb12u1

  • ubuntu•linux

    all | all | all | all | < 7.0.0-31.31

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | all | all | all | < 7.0.0-1012.12

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    all

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    all

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.14

    all

  • ubuntu•linux-aws-6.17

    all

  • ubuntu•linux-aws-6.2

    all

  • ubuntu•linux-aws-6.5

    all

  • ubuntu•linux-aws-6.8

    all

  • ubuntu•linux-aws-7.0

    all | < 7.0.0-1012.12~24.04.1

  • ubuntu•linux-aws-fips

    all

  • ubuntu•linux-aws-hwe

    all

  • ubuntu•linux-azure

    all | all | all | all | all

  • ubuntu•linux-azure-4.15

    all

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    all

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    all

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-6.14

    all

  • ubuntu•linux-azure-6.17

    all

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-6.5

    all

  • ubuntu•linux-azure-6.8

    all

  • ubuntu•linux-azure-7.0

    all

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | all | all | all

  • ubuntu•linux-azure-fde-5.15

    all

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fde-6.14

    all

  • ubuntu•linux-azure-fde-6.17

    all

  • ubuntu•linux-azure-fde-6.2

    all

Showing first 50 affected entries in server-rendered view.

References (20)