{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers  flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp-\u003ecl_session is NULL; it uses clp-\u003ecl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses:    - nfs4_init_ds_session() dereferences clp-\u003ecl_session-\u003esession_state     while seeding the DS lease. It also only seeds cl_lease_time when     NFS4_SESSION_INITING is set; without a session that never happens, so     cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing     every 5 seconds. Seed the lease whenever there is no session and     return before touching session state.    - ff_layout_async_handle_error_v4() dereferences     clp-\u003ecl_session-\u003efc_slot_table on every DS I/O error. Fall back to the     v4.0 transport slot table (clp-\u003ecl_slot_tbl) when there is no session.",
  "id": "DEBIAN-CVE-2026-90149",
  "modified": "2026-09-18T04:47:25.126312084Z",
  "published": "2026-09-17T17:17:07.830Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90149"
    }
  ],
  "upstream": [
    "CVE-2026-90149"
  ]
}