CVE-2026-53391

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, -.-) to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only -nlen < 0- / -rlen < 0- before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its -*str = NULL; return ret- tail, leaving buf NULL with a return value of 0. The -< 0- check does not catch this, and the next line is strrchr(NULL, -.-), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.