CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix XDR length calculation in nfsd4ffencodelayoutget
The XDR buffer size calculation in nfsd4ffencodelayoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client:
- fhlen doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdrencodeopaque() actually writes "4 + xdralignsize(len)" bytes - dslen omits the flags and statscollecthint fields (8 bytes), while len's header constant overestimates by 8 bytes -- these partially cancel but leave a net mismatch
The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client.
Fix this by breaking out every encoded field explicitly in the dslen calculation, using xdralignsize() for all variable-length opaque fields, and correcting the header constants.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (nfsd4_ff_encode_layoutget)to a version that resolves this vulnerability.Patch nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel NFS server code path that uses nfsd4_ff_encode_layoutget() are exposed. The issue affects responses encoded for clients, where an incorrect XDR buffer reservation can either overrun the reserved buffer or return stale kernel-buffer contents.
What conditions make the out-of-bounds write most likely?
The worst case described uses short uid and gid strings, such as uid=0 and gid=0, together with an odd-sized file handle. Under those conditions, the function can write up to 5 bytes beyond the reserved XDR buffer.
When can kernel memory be disclosed to a client?
Disclosure can occur when the relevant string lengths are 4-byte aligned. In that case the buffer reservation is larger than needed, and stale contents from the buffer can be transmitted to the client.
What is the remediation?
Apply a kernel update containing the fix that explicitly calculates each encoded field, aligns variable-length opaque fields with xdr_align_size(), and corrects the header constants. The provided stable-kernel references identify commits containing the resolved change.