{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.746Z", "datePublished": "2026-09-11T19:45:58.883Z", "dateUpdated": "2026-09-11T19:45:58.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:45:58.883Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "versions": [{"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "e7d9d23ecd9172f05b09bb678ff22db8e361c428", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "0380129b1373c437eb35401a174671c8888f4b80", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "f9868174af49d207fbaf0c5e055d088a983684af", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"}, {"url": "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"}, {"url": "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"}, {"url": "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"}], "title": "nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e7d9d23ecd9172f05b09bb678ff22db8e361c428", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "0380129b1373c437eb35401a174671c8888f4b80", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "f9868174af49d207fbaf0c5e055d088a983684af", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants."}], "id": "CVE-2026-89674", "lastModified": "2026-09-11T20:19:54.013", "metrics": {}, "published": "2026-09-11T20:19:54.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel nfsd: Memory corruption and information disclosure via XDR length calculation error.", "id": "2532385", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532385"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the `nfsd` component of the Linux kernel. Incorrect calculations in the XDR (External Data Representation) buffer size within the `nfsd4_ff_encode_layoutget()` function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory boundaries, which might result in system instability or denial of service. Additionally, this flaw could cause the system to expose sensitive, uninitialized kernel memory to a client, leading to information disclosure."], "name": "CVE-2026-89674", "public_date": "2026-09-11T19:45:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89674\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89674\nhttps://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80\nhttps://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43\nhttps://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428\nhttps://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"], "threat_severity": "Important"}

{"created": "2026-09-12T07:30:10.434606+00:00", "updated": "2026-09-12T16:45:07.522557+00:00", "vendors": []}