CVE-2026-89673
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode. Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.
How to fix
- Linux Linux356decf074b82bac5564568203c12426dcea3470, 15460c8e6c9bc92cda8f68bc419ac082300ab3d6, 9be67a6be48ddf2ebaa98c0df671690b8f9666e7, 88bce7e326c368d7df15126ccac537e54bebd467, 74015b7be806ad9e21d46f7bd2831df280c6c783, 41ebca28e17f84293650598f86bd69532ec1a8e0, 62e5949f0dd5ec837af144860ff908369df4c7c9, 8b989aaec85e1293a871d602590c951fe44b8647, 5.10.270, 5.15.221, 6.1.188, 4.15, 4.20, 5.5, 6.5, 6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3f1a2b0b2d575f39ff0bedb5411822fe7446a805 ≤ v < 356decf074b82bac5564568203c12426dcea3470, 19a648a07572c70fbe16faf0fafaf3dce9fd998a ≤ v < 15460c8e6c9bc92cda8f68bc419ac082300ab3d6, 6d08bd22fa2941a4d5ef45ed115dd00e484a93d7 ≤ v < 9be67a6be48ddf2ebaa98c0df671690b8f9666e7, 6372e2ee629894433fe6107d7048536a3280a284 ≤ v < 88bce7e326c368d7df15126ccac537e54bebd467, 6372e2ee629894433fe6107d7048536a3280a284 ≤ v < 74015b7be806ad9e21d46f7bd2831df280c6c783, 6372e2ee629894433fe6107d7048536a3280a284 ≤ v < 41ebca28e17f84293650598f86bd69532ec1a8e0, 6372e2ee629894433fe6107d7048536a3280a284 ≤ v < 62e5949f0dd5ec837af144860ff908369df4c7c9, 6372e2ee629894433fe6107d7048536a3280a284 ≤ v < 8b989aaec85e1293a871d602590c951fe44b8647, 82e36f0c287769a0430268739a71dbd56df0e679, 6370e66a71c4869247f8f406c2a8b2c43df8998f, 16282aeca44bfac0d1ac3be6cd1a719d6ff3d749, efcae97fa425ca6db9d126e37daccf2d7225cb09, 64c959d59c24c661bd5338e4e6f1f703d7c309a1, 5.10.195 ≤ v < 5.10.270, 5.15.132 ≤ v < 5.15.221, 6.1.53 ≤ v < 6.1.188, 4.14.326 ≤ v < 4.15, 4.19.295 ≤ v < 4.20, 5.4.257 ≤ v < 5.5, 6.4.16 ≤ v < 6.5, 6.5.3 ≤ v < 6.6, 6.6 | 356decf074b82bac5564568203c12426dcea3470, 15460c8e6c9bc92cda8f68bc419ac082300ab3d6, 9be67a6be48ddf2ebaa98c0df671690b8f9666e7, 88bce7e326c368d7df15126ccac537e54bebd467, 74015b7be806ad9e21d46f7bd2831df280c6c783, 41ebca28e17f84293650598f86bd69532ec1a8e0, 62e5949f0dd5ec837af144860ff908369df4c7c9, 8b989aaec85e1293a871d602590c951fe44b8647, 5.10.270, 5.15.221, 6.1.188, 4.15, 4.20, 5.5, 6.5, 6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.