CVE-2026-105516

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Teddy Thobane (rootkiTed) for reporting this issue.", "bugzilla": {"description": "nfs-ganesha: nfs-ganesha: 9P TWALK component count stack buffer overflow", "id": "2545962", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545962"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-121", "details": ["A stack buffer overflow vulnerability was found in the 9P protocol implementation of NFS-Ganesha. The server does not validate the number of path components in a TWALK request against the protocol-defined limit of 16. An attacker can send a specially crafted TWALK message with thousands of path components, causing the server to write past the end of a fixed-size stack buffer during response construction. This can result in a crash or potentially remote code execution. The 9P protocol handler does not implement authentication, so the vulnerability is reachable without credentials by any client with network access to the 9P listener."], "mitigation": {"lang": "en:us", "value": "The 9P protocol support is not compiled in the versions of nfs-ganesha shipped in Red Hat products and Fedora. Only deployments that explicitly build nfs-ganesha with USE_9P=ON and expose a 9P listener are affected."}, "name": "CVE-2026-105516", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Not affected", "package_name": "nfs-ganesha", "product_name": "Red Hat Ceph Storage 4"}], "public_date": "2026-10-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105516\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105516"], "statement": "Red Hat's versions of nfs-ganesha do not compile the 9P protocol support, so this vulnerability does not affect any Red Hat products.", "threat_severity": "Critical"}

{"created": "2026-10-06T13:45:18.453622+00:00", "updated": "2026-10-06T13:45:18.453636+00:00", "vendors": []}