CVE-2026-90103

A flaw was found in the Linux kernel's NFSv4.2 (Network File System version 4.2) component. A malicious or specially crafted data server can exploit an issue in the LAYOUTSTATS handling, where the send buffer can be exhausted due to an undersized allocation. This can lead to a permanent lock being held, resulting in a Denial of Service (DoS) condition for the affected system.

A moderate severity flaw was found in the Linux kernel's NFSv4.2 handling of LAYOUTSTATS. The encode_layoutstats_maxsz macro reserves only 256 bytes for the layoutupdate4 body written by the layout driver, but the flexfiles layout driver can emit a record that exceeds this reservation: a data server filehandle of NFS_MAXFHSIZE bytes combined with the per-data-server address, I/O latency, timestamp, and boolean fields pushes the encoded body past the 256-byte budget before the address is encoded at all. Because the filehandle and the address are chosen by the server through LAYOUTGET and GETDEVICEINFO, a malicious or specially crafted data server can drive the encoder past the end of the send buffer. When that happens, xdr_reserve_space() returns NULL while the mirror lock is held, leaving the lock permanently held and resulting in a denial of service on the NFS client. Exploitation requires a client to use an NFSv4.2 mount with pNFS flexfiles layouts served by a malicious or untrusted server, which limits exposure in typical deployments. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the Red Hat CoreOS kernels shipped in OpenShift Container Platform 4 are affected; fixes for these streams are currently deferred to a future update, and the residual risk is denial of service limited to clients using pNFS flexfiles layouts against an untrusted server. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Red Hat rates this flaw as moderate severity (CVSS 5.5 with a local attack vector), which differs from the upstream CVE record score of 7.5 that assumes a network attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.