Linux Kernel NFSv4 Flexfiles Zero Filehandle Version Rejection

CVE-2026-53392 is a memory handling vulnerability in the Linux kernel's NFSv4 flexfiles layout implementation. The vulnerability occurs when the filehandle-version array count is decoded from the flexfiles layout body and a zero count value is passed to kzalloc_objs(), resulting in ZERO_SIZE_PTR being stored in dss_info->fh_versions. This matters because downstream code assumes at least one filehandle version exists, creating a potential null pointer dereference or out-of-bounds access condition. This affects systems running vulnerable Linux kernels that handle NFSv4 flexfiles layouts, particularly in environments where untrusted or malicious NFS servers can provide crafted layout bodies to trigger the condition.

While this CVE lacks mapped MITRE ATT&CK techniques and currently has zero matching Casky skills, practitioners using Casky.ai's Claude AI-powered platform would benefit from its extended reasoning capabilities to identify related attack patterns. Detection would focus on reconnaissance and exploitation behaviors: monitoring for unusual NFSv4 flexfiles layout requests with anomalous filehandle counts (Technique T1592 - Gather Victim Identity Information), kernel memory access violations suggesting exploitation attempts, and abnormal NFS server communication patterns. When Casky skills mature to cover memory corruption and kernel exploitation patterns, the platform could correlate kernel crash logs, memory sanitizer outputs, and suspicious RPC traffic to flag potential CVE-2026-53392 exploitation attempts before they result in privilege escalation or denial of service.