CVE-2021-47168

NFS: fix an incorrect limit in filelayout_decode_layout()

State: Published
Severity: 9.8 Critical
Published: Mar 25, 2024
Updated: Aug 5, 2026
Reserved: Mar 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix an incorrect limit in filelayout_decode_layout()

The "sizeof(struct nfs_fh)" is two bytes too large and could lead to memory corruption. It should be NFS_MAXFHSIZE because that's the size of the ->data[] buffer.

I reversed the size of the arguments to put the variable on the left.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	16b374ca439fb406e46e071f75428f5b033056f8 to before 9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040Affected 16b374ca439fb406e46e071f75428f5b033056f8 to before b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1Affected 16b374ca439fb406e46e071f75428f5b033056f8 to before f299522eda1566cbfbae4b15c82970fc41b03714Affected 16b374ca439fb406e46e071f75428f5b033056f8 to before 945ebef997227ca8c20bad7f8a8358c8ee57a84aAffected 16b374ca439fb406e46e071f75428f5b033056f8 to before e411df81cd862ef3d5b878120b2a2fef0ca9cdb1Affected 16b374ca439fb406e46e071f75428f5b033056f8 to before 9b367fe770b1b80d7bf64ed0d177544a44405f6eAffected 16b374ca439fb406e46e071f75428f5b033056f8 to before d34fb628f6ef522f996205a9e578216bbee09e84Affected 16b374ca439fb406e46e071f75428f5b033056f8 to before 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8Affected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 4.4.271 through 4.4.Not affected 4.9.271 through 4.9.Not affected 4.14.235 through 4.14.Not affected 4.19.193 through 4.19.Not affected 5.4.124 through 5.4.Not affected 5.10.42 through 5.10.Not affected 5.12.9 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

16b374ca439fb406e46e071f75428f5b033056f8 to before 9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040Affected
16b374ca439fb406e46e071f75428f5b033056f8 to before b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1Affected
16b374ca439fb406e46e071f75428f5b033056f8 to before f299522eda1566cbfbae4b15c82970fc41b03714Affected
16b374ca439fb406e46e071f75428f5b033056f8 to before 945ebef997227ca8c20bad7f8a8358c8ee57a84aAffected
16b374ca439fb406e46e071f75428f5b033056f8 to before e411df81cd862ef3d5b878120b2a2fef0ca9cdb1Affected
16b374ca439fb406e46e071f75428f5b033056f8 to before 9b367fe770b1b80d7bf64ed0d177544a44405f6eAffected
16b374ca439fb406e46e071f75428f5b033056f8 to before d34fb628f6ef522f996205a9e578216bbee09e84Affected
16b374ca439fb406e46e071f75428f5b033056f8 to before 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8Affected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
4.4.271 through 4.4.*Not affected
4.9.271 through 4.9.*Not affected
4.14.235 through 4.14.*Not affected
4.19.193 through 4.19.*Not affected
5.4.124 through 5.4.*Not affected
5.10.42 through 5.10.*Not affected
5.12.9 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.