CVE-2026-90103

A moderate severity flaw was found in the Linux kernel's NFSv4.2 handling of LAYOUTSTATS. The encode_layoutstats_maxsz macro reserves only 256 bytes for the layoutupdate4 body written by the layout driver, but the flexfiles layout driver can emit a record that exceeds this reservation: a data server filehandle of NFS_MAXFHSIZE bytes combined with the per-data-server address, I/O latency, timestamp, and boolean fields pushes the encoded body past the 256-byte budget before the address is encoded at all. Because the filehandle and the address are chosen by the server through LAYOUTGET and GETDEVICEINFO, a malicious or specially crafted data server can drive the encoder past the end of the send buffer. When that happens, xdr_reserve_space() returns NULL while the mirror lock is held, leaving the lock permanently held and resulting in a denial of service on the NFS client. Exploitation requires a client to use an NFSv4.2 mount with pNFS flexfiles layouts served by a malicious or untrusted server, which limits exposure in typical deployments. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the Red Hat CoreOS kernels shipped in OpenShift Container Platform 4 are affected; fixes for these streams are currently deferred to a future update, and the residual risk is denial of service limited to clients using pNFS flexfiles layouts against an untrusted server. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Red Hat rates this flaw as moderate severity (CVSS 5.5 with a local attack vector), which differs from the upstream CVE record score of 7.5 that assumes a network attack vector.