CVE-2026-98250 nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
A logic error in the Linux kernel's NFS server netlink codepath can lead to a denial of service when handling parallel NFS exports.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98250?
CVE-2026-98250 is a vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
The rework of how block layouts were checked moved the check for NFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. That patch didn't account for the new call in nfsd4_setup_layout_type().
Which versions are affected by CVE-2026-98250?
How do I fix CVE-2026-98250?
Apply the vendor's patch.
Is CVE-2026-98250 being exploited?
There is no known exploitation of CVE-2026-98250 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98250, GHSA-vc4w-f249-26qv, UBUNTU-CVE-2026-98250.