SB20260912116 - Improper Handling of Length Parameter Inconsistency in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/41ebca28e17f84293650598f86bd69532ec1a8e0
• https://git.kernel.org/stable/c/62e5949f0dd5ec837af144860ff908369df4c7c9
• https://git.kernel.org/stable/c/74015b7be806ad9e21d46f7bd2831df280c6c783
• https://git.kernel.org/stable/c/8b989aaec85e1293a871d602590c951fe44b8647