SB20260912101 - Out-of-bounds write in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80
• https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43
• https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428
• https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af