CVE-2026-89674nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
- 9.8CriticalCVSS base score
- 0.51%Exploitation in 30 daysEPSS · top 56% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client: - fh_len doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually writes "4 + xdr_align_size(len)" bytes - ds_len omits the flags and stats_collect_hint fields (8 bytes), while len's header constant overestimates by 8 bytes -- these partially cancel but leave a net mismatch The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client. Fix this by breaking out every encoded field explicitly in the ds_len calculation, using xdr_align_size() for all variable-length opaque fields, and correcting the header constants.
Timeline
ID reserved
By Linux
Published
- 38 days later
· 38 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.51% · top 56% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < 3a7fd224df0fbb42167eb1b77be45d72fe0b1098
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < 29e4478e2ed5a227e8f0c33cacb91bf227cedd47
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < 65a72b721943618eeb3a41c8b36e915591f3f83f
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < bee826c00ac900473f91306f1f3e5a5a81fd4a74
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < e7d9d23ecd9172f05b09bb678ff22db8e361c428
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < 0380129b1373c437eb35401a174671c8888f4b80
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < c81cef6a805dec266c10fc4f83c93d6fcf1a2b43
- affected 9b9960a0ca4773e21c4b153ed355583946346b25 – < f9868174af49d207fbaf0c5e055d088a983684af
- affected 4.8
- unaffected < 4.8
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098 (opens in a new tab)
- https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47 (opens in a new tab)
- https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f (opens in a new tab)
- https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74 (opens in a new tab)
- https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428 (opens in a new tab)
- https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80 (opens in a new tab)
- https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43 (opens in a new tab)
- https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76586 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89674)Record last updated .