USN-9008-1: libnfs vulnerability

Q: What must an attacker be able to do to exploit this issue?

An attacker would need to trigger ZDR decoding of data that exceeds the intended maximum size bound in libnfs. The provided information does not specify the network path, authentication requirements, or affected application workflows.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can cause a libnfs crash and denial of service. It may also allow arbitrary code execution because the flaw results in an out-of-bounds write.

Q: Which Ubuntu libnfs packages are identified as affected?

The advisory identifies ubuntu/libnfs14 and ubuntu/libnfs13. It does not provide fixed package versions in the supplied data.

Published Nov 9, 2026

Updated

It was discovered that libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly use this issue to cause libnfs to crash, resulting in a denial of service, or execute arbitrary code.

Affected Software

8 affected componentsFixes available

All of the following

ubuntu/libnfs14<5.0.2-1ubuntu3.1

5.0.2-1ubuntu3.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/libnfs14<5.0.2-1ubuntu1.2

5.0.2-1ubuntu1.2

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libnfs14<5.0.2-1ubuntu0.24.04.2

5.0.2-1ubuntu0.24.04.2

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libnfs13<4.0.0-1ubuntu0.2

4.0.0-1ubuntu0.2

Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libnfs14 to a version that resolves this vulnerability.
Fixed in 5.0.2-1ubuntu3.1
Upgrade
Upgrade ubuntu/libnfs14 to a version that resolves this vulnerability.
Fixed in 5.0.2-1ubuntu1.2
Upgrade
Upgrade ubuntu/libnfs14 to a version that resolves this vulnerability.
Fixed in 5.0.2-1ubuntu0.24.04.2
Upgrade
Upgrade ubuntu/libnfs13 to a version that resolves this vulnerability.
Fixed in 4.0.0-1ubuntu0.2

Event History

Nov 9, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108985

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker would need to trigger ZDR decoding of data that exceeds the intended maximum size bound in libnfs. The provided information does not specify the network path, authentication requirements, or affected application workflows.

What is the potential impact if exploitation succeeds?

Successful exploitation can cause a libnfs crash and denial of service. It may also allow arbitrary code execution because the flaw results in an out-of-bounds write.

Which Ubuntu libnfs packages are identified as affected?

The advisory identifies ubuntu/libnfs14 and ubuntu/libnfs13. It does not provide fixed package versions in the supplied data.

USN-9008-1: libnfs vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which Ubuntu libnfs packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which Ubuntu libnfs packages are identified as affected?