Bug 2546384 (CVE-2026-98250)

Summary:	CVE-2026-98250 kernel: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Network File System daemon (nfsd). When configuring file exports through the Netlink interface, nfsd attempts to initialize parallel NFS (pNFS) layouts without verifying that pNFS is enabled for the export. A privileged local user managing NFS exports could trigger this condition, potentially leading to improper export configuration and unexpected system behavior or a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 09:10:55 UTC

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix handling of NFSEXP_PNFS in the netlink codepath

The rework of how block layouts were checked moved the check for
NFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. That
patch didn't account for the new call in nfsd4_setup_layout_type().

Comment 1 gkamathe 2026-10-11 05:45:56 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98250.mbox