Cloudanix VulnDB

CVE-2026-98250

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing server could let remote systems request special file-access settings that the server should have blocked, potentially causing errors or instability.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing validation of the NFSEXP_PNFS flag inside nfsd4_setup_layout_type when invoked from the netlink code path allows callers to request pNFS layouts without the export having been configured for them, resulting in invalid layout state being set up.

Why it matters to the business

NFS servers may serve incorrect or unsafe pNFS layout information to clients, leading to data-access anomalies, client crashes, or server instability until the kernel is updated.

How an attack unfolds

An attacker with network access to an nfsd instance sends crafted NFSv4 layout requests over the netlink control path; because the PNFS check was omitted, the server accepts the request and returns layout information that violates the export flags, which the client can then use to trigger further misbehavior.

How to fix it

Upgrade to a Linux kernel containing the referenced nfsd fix; rebuild and reboot nfsd hosts with the corrected kernel. No configuration workaround exists.

How to confirm the fix worked

Confirm the running kernel contains the commit that restores the NFSEXP_PNFS check inside nfsd4_setup_layout_type; re-test netlink-originated layout requests against exports that lack the PNFS flag.

Typical attack path

  1. Reach an nfsd instance that exports filesystems via NFSv4
  2. Issue layout requests through the netlink interface that bypass the missing NFSEXP_PNFS test
  3. Receive and use the resulting invalid layout information to cause client or server errors

How to detect it

Review nfsd and netlink audit logs for unexpected layout-type requests on exports that do not have the pNFS flag set; correlate with client layout responses that contain pNFS information when it should have been denied.

What your security team should do

  • Prioritize kernel updates on all systems running nfsd with NFSv4 exports
  • Monitor upstream stable and distribution kernel changelogs for the exact patch
  • After patching, verify that pNFS layout requests are rejected when the export flag is absent

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. That patch didn't account for the new call in nfsd4_setup_layout_type().

Affected packages

Ecosystem Package Introduced Fixed