CVE-2026-90149

CVE-2026-90149 is a NULL pointer dereference in the Linux kernel 's NFSv4/flexfiles subsystem. The flexfiles layout accepts NFSv4.0 data servers, but two code paths incorrectly assume the data server client has a session object (clp->cl_session). Unlike NFSv4.1+, an NFSv4.0 client has no sessi...

EUVD-2026-81742

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...