OESA-2026-4731: libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions. Security Fix(es):
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes(), libnfszdrstring(), and libnfszdrarray(). The caller-supplied maxsize value is not honored.(CVE-2026-108985)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libnfsto a version that resolves this vulnerability.Fixed in 5.0.2-4.oe2403sp1 - Upgrade
Upgrade
libnfsto a version that resolves this vulnerability.Patch 7613236
Event History
Frequently Asked Questions
What access does an attacker need to attempt exploitation?
The CVSS vector indicates a network-accessible attack path with low complexity and no privileges required. User interaction is required.
Which affected code should be prioritized for review?
The issue is in ZDR decoding, specifically libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array() in lib/libnfs-zdr.c. These routines fail to honor a caller-supplied maxsize value, leading to an out-of-bounds write.
How can I determine whether my libnfs installation is affected?
Identify whether the installed libnfs version is through 6.0.2 and lacks commit 7613236. The advisory does not provide the fixed package version for openEuler, so compare installed package contents or vendor update status against that fix.