In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53391 is a null pointer dereference vulnerability in the Linux kernel's NFSv4/pNFS implementation, specifically in the nfs4_decode_mp_ds_addr() function. This function processes network address information from GETDEVICEINFO responses used in parallel NFS data server (pNFS) operations. When a zero-length r_addr opaque is provided, the kernel fails to validate the string before attempting to locate a port separator using strrchr(), leading to potential kernel crashes or denial of service. This affects any system using NFSv4 with pNFS multipath data server configurations, including enterprise storage infrastructures and cloud environments relying on NFS for distributed file access.
While Casky.ai's current skill set (0 matching skills identified) doesn't yet map this specific vulnerability to MITRE ATT&CK techniques, practitioners using the platform would benefit from monitoring for T1561 (Disk Wipe), T1499 (Endpoint Denial of Service), and T1565 (Data Manipulation) patterns. Detection would focus on identifying malicious GETDEVICEINFO responses with crafted zero-length netaddr4 opaques sent to NFS clients, unusual kernel error logs related to NFS decoding operations, and unexpected system crashes on hosts mounting NFSv4 pNFS datastores. Security teams should correlate network traffic showing suspicious GETDEVICEINFO responses with corresponding system stability issues to identify exploitation attempts.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53391. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation