In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFSINOLAYOUTCOMMIT in pnfsmarklayoutstateidinvalid Fixes a crash when layout is null during this call stack: writeinode -> nfs4writeinode -> pnfslayoutcommitinode pnfssetlayoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFSINO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.