Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90102— NFSv4/pnfs: key the data server cache on the NFS version

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： NFSv4/pnfs：根据 NFS 版本对数据服务器缓存进行键控 目前仅以多路径地址集作为 per-net 数据服务器缓存的键，且 结构体未记录 NFS 版本信息。对于 files 布局驱动程序来说，这种设计是足够的，因为它始终以 NFSv4 版本建立连接；但 flexfiles 会从每个设备的 响应中获取版本元组，因此同一个地址在合法情况下可能同时服务于 NFSv3 和 NFSv4。 当同一个地址上存在两个 deviceid，且它们的 不同时，两者会共享同一个 实例。无论

CVSS 7.5 · High EPSS 0.72% · P52

Possible ATT&CK Techniques 1 AI

T1590 · Gather Victim Network Information

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux d67ae825a59d639e4d8b82413af84d854617a87e< ffb100b0da0e217d5d63ce6fe092f9c29e59f7dd affected
d67ae825a59d639e4d8b82413af84d854617a87e< 02e160922bc83cd25e346a028ed43cbdb0b57e1a affected
d67ae825a59d639e4d8b82413af84d854617a87e< bc7aa9d8aff826031ffe25eba7f2f3acafcbf7a1 affected
d67ae825a59d639e4d8b82413af84d854617a87e< dd5bd091daa48c6ed8f9235ddf448aa288a0881f affected
d67ae825a59d639e4d8b82413af84d854617a87e< f2994ba1263d9e88d3d9ae1d097c5cf811d4bfa5 affected
d67ae825a59d639e4d8b82413af84d854617a87e< 27f640cd92eebf5c2f64336be7ca24f4636390cb affected
d67ae825a59d639e4d8b82413af84d854617a87e< bbc975cfb07a146843fde1126c43441e76177539 affected
d67ae825a59d639e4d8b82413af84d854617a87e< 13c23c5cb977f66390795437fd3837887ce1fd75 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90102

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFSv4/pnfs: key the data server cache on the NFS version
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4_pnfs_ds_add() keys the per-net data server cache on the multipath address set alone, and struct nfs4_pnfs_ds records no version. That suffices for the files layout driver, which always connects with version 4, but flexfiles takes its version tuple from GETDEVICEINFO per device, and one address can legitimately serve both NFSv3 and NFSv4. Two deviceids on one address with different ds_versions[0].version therefore share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other one is handed that client anyway, so it selects rpc_call_ops for a version the connection does not speak, and the mismatched sequence-slot handling dereferences NULL. Add the version to the cache key so the two cannot alias, giving each version its own nfs4_pnfs_ds and connection while both mirrors stay usable. Only the major version is compared, since that is what selects rpc_call_ops and rpc_ops; v4.0 and v4.1 keep sharing a client. The files layout driver passes the 4 it already hardcodes at connect time.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d67ae825a59d639e4d8b82413af84d854617a87e ~ ffb100b0da0e217d5d63ce6fe092f9c29e59f7dd -
Linux Linux 4.0 -

II. Public POCs for CVE-2026-90102

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90102

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90102 (7)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90255 8.8 HIGH Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90102

No comments yet

Leave a comment