Riskcovery

CVE-2026-89673

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

State
Published
Severity
Not scored
Published
Sep 11, 2026
Updated
Oct 24, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode.

Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3f1a2b0b2d575f39ff0bedb5411822fe7446a805 to before 356decf074b82bac5564568203c12426dcea3470Affected
  • 19a648a07572c70fbe16faf0fafaf3dce9fd998a to before 15460c8e6c9bc92cda8f68bc419ac082300ab3d6Affected
  • 6d08bd22fa2941a4d5ef45ed115dd00e484a93d7 to before 9be67a6be48ddf2ebaa98c0df671690b8f9666e7Affected
  • 6372e2ee629894433fe6107d7048536a3280a284 to before 88bce7e326c368d7df15126ccac537e54bebd467Affected
  • 6372e2ee629894433fe6107d7048536a3280a284 to before 74015b7be806ad9e21d46f7bd2831df280c6c783Affected
  • 6372e2ee629894433fe6107d7048536a3280a284 to before 41ebca28e17f84293650598f86bd69532ec1a8e0Affected
  • 6372e2ee629894433fe6107d7048536a3280a284 to before 62e5949f0dd5ec837af144860ff908369df4c7c9Affected
  • 6372e2ee629894433fe6107d7048536a3280a284 to before 8b989aaec85e1293a871d602590c951fe44b8647Affected
  • 82e36f0c287769a0430268739a71dbd56df0e679Affected
  • 6370e66a71c4869247f8f406c2a8b2c43df8998fAffected
  • 16282aeca44bfac0d1ac3be6cd1a719d6ff3d749Affected
  • efcae97fa425ca6db9d126e37daccf2d7225cb09Affected
  • 64c959d59c24c661bd5338e4e6f1f703d7c309a1Affected
  • 5.10.195 to before 5.10.270Affected
  • 5.15.132 to before 5.15.221Affected
  • 6.1.53 to before 6.1.188Affected
  • 4.14.326 to before 4.15Affected
  • 4.19.295 to before 4.20Affected
  • 5.4.257 to before 5.5Affected
  • 6.4.16 to before 6.5Affected
  • 6.5.3 to before 6.6Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 5.10.270 through 5.10.*Not affected
  • 5.15.221 through 5.15.*Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.109 through 6.12.*Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.