CVE-2026-89674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.746Z", "datePublished": "2026-09-11T19:45:58.883Z", "dateUpdated": "2026-10-19T08:50:47.609Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:50:47.609Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in nfsd's pNFS flexfile LAYOUTGET encoder (nfsd4_ff_encode_layoutget). A remote NFSv4.1 client reaches it over TCP/2049 via COMPOUND SEQUENCE, PUTFH, OPEN, and LAYOUTGET on the in-kernel NFS server.\nAC:L - A client that can OPEN a file on a flexfile pNFS export issues LAYOUTGET and hits the miscalculated xdr_reserve_space length. Root-owned files yield uid/gid \"0\", and PUTFH may append 1-3 bytes ignored by fh_verify so fh.size is odd; no race is required.\nPR:N - Typical nfsd deployments accept AUTH_SYS/AUTH_NULL without cryptographic authentication. Any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, PUTFH/OPEN, and LAYOUTGET; no local account on the NFS server is required.\nUI:N - The attacking NFS client drives the compounds that open a file and request a flexfile layout. No victim user action such as mounting a filesystem or opening a file on the server is required.\nS:U - The out-of-bounds write and kernel-memory leak occur in the NFS server host's XDR reply buffer. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - When the reservation is too large, stale uninitialized kernel bytes in the RPC reply are sent to the client. The matching out-of-bounds write is kernel memory corruption that can be leveraged for information disclosure per CVSS kernel guidance.\nI:H - Worst case the encoder writes up to 5 bytes past the xdr_reserve_space region, including across a reply-page boundary into adjacent kernel memory. Kernel CNA guidance scores out-of-bounds writes as High integrity impact.\nA:H - A write past the current XDR page (xdr->end) into an unmapped or unrelated page oopses or panics nfsd. The attacker can pad prior COMPOUND ops to place the LAYOUTGET encode at a page boundary and repeat the request to deny service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "versions": [{"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "3a7fd224df0fbb42167eb1b77be45d72fe0b1098", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "29e4478e2ed5a227e8f0c33cacb91bf227cedd47", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "65a72b721943618eeb3a41c8b36e915591f3f83f", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "bee826c00ac900473f91306f1f3e5a5a81fd4a74", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "e7d9d23ecd9172f05b09bb678ff22db8e361c428", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "0380129b1373c437eb35401a174671c8888f4b80", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "status": "affected", "versionType": "git"}, {"version": "9b9960a0ca4773e21c4b153ed355583946346b25", "lessThan": "f9868174af49d207fbaf0c5e055d088a983684af", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098"}, {"url": "https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47"}, {"url": "https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f"}, {"url": "https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74"}, {"url": "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"}, {"url": "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"}, {"url": "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"}, {"url": "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"}], "title": "nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3a7fd224df0fbb42167eb1b77be45d72fe0b1098", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "29e4478e2ed5a227e8f0c33cacb91bf227cedd47", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "65a72b721943618eeb3a41c8b36e915591f3f83f", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "bee826c00ac900473f91306f1f3e5a5a81fd4a74", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "e7d9d23ecd9172f05b09bb678ff22db8e361c428", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "0380129b1373c437eb35401a174671c8888f4b80", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}, {"lessThan": "f9868174af49d207fbaf0c5e055d088a983684af", "status": "affected", "version": "9b9960a0ca4773e21c4b153ed355583946346b25", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/flexfilelayoutxdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants."}], "id": "CVE-2026-89674", "lastModified": "2026-10-19T09:18:05.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:54.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel nfsd: Memory corruption and information disclosure via XDR length calculation error.", "id": "2532385", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532385"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the `nfsd` component of the Linux kernel. Incorrect calculations in the XDR (External Data Representation) buffer size within the `nfsd4_ff_encode_layoutget()` function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory boundaries, which might result in system instability or denial of service. Additionally, this flaw could cause the system to expose sensitive, uninitialized kernel memory to a client, leading to information disclosure."], "name": "CVE-2026-89674", "public_date": "2026-09-11T19:45:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89674\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89674\nhttps://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80\nhttps://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43\nhttps://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428\nhttps://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9b9960a0ca4773e21c4b153ed355583946346b25,e7d9d23ecd9172f05b09bb678ff22db8e361c428)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9b9960a0ca4773e21c4b153ed355583946346b25,0380129b1373c437eb35401a174671c8888f4b80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9b9960a0ca4773e21c4b153ed355583946346b25,c81cef6a805dec266c10fc4f83c93d6fcf1a2b43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9b9960a0ca4773e21c4b153ed355583946346b25,f9868174af49d207fbaf0c5e055d088a983684af)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.109,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.50,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.4,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:30:10.434606+00:00", "updated": "2026-09-15T20:30:10.345503+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}