CVE-2024-26868

A vulnerability was found in the ff_layout_cancel_io() function in the Linux kernel. Improper error checking with the mirror_ds structure fails to check if it is NULL, leading to a potential NULL pointer dereference. This issue could lead to crashes.

A MODERATE severity NULL pointer dereference flaw was found in the Linux kernel NFS client's pNFS flexible file layout (flexfiles) implementation, affecting the Red Hat Enterprise Linux 9 kernel and kernel-rt. When nfs4_ff_layout_prepare_ds() fails to initialize the mirror data server (mirror_ds) structure, ff_layout_cancel_io() checks mirror_ds only for NULL instead of using IS_ERR_OR_NULL, so the error cleanup path dereferences an invalid pointer and the kernel panics; this crash was observed upstream in production during writeback on an NFS flexfiles mount. The impact is a local denial of service with no impact on confidentiality or integrity: a low-privileged local user able to perform I/O on an NFSv4 flexfiles mount can trigger the panic. Red Hat and NIST rate this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the CVE.org record scores it 7.5 with a network attack vector; Red Hat's assessment reflects that triggering the flaw requires local activity on an NFS client using the flexfiles layout rather than remote network access. The RHEL 9.2 update stream was assessed as not affected, and Red Hat Enterprise Linux 8 is not affected because its kernel does not contain the affected code, which was introduced in the upstream 6.1 kernel; the hosted OpenShift (ARO/OSD) streams are likewise not affected. Fixes for the affected Red Hat Enterprise Linux 9 kernel streams are being pursued through the delegated kernel maintenance process, and Fedora kernels containing the vulnerable code are also affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.