CVE-2026-53391

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4_decode_mp_ds_addr function, responsible for decoding network address information, does not properly handle zero-length r_addr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length r_addr, leading to a NULL pointer dereference and causing the client system to panic, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires a client system to connect to and mount an untrusted or compromised NFS metadata server, limiting the blast radius to client-side denial of service. Standard NFS configurations and environments that only communicate with trusted network storage are not exposed to unsolicited attacks. While the issue can trigger a kernel crash when parsing malformed device address responses under parallel NFS (pNFS) flexfile layouts, it does not permit privilege escalation or confidential data disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.