CVE-2026-89673

Received Received - Intake

XDR Padding Miscalculation in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode. Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89673

EUVD

EUVD-2026-76585

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect XDR padding calculation in the NFS server's flexfile GETDEVICEINFO operation. The function nfsd4_ff_encode_getdeviceinfo reserves more space than needed for address data, causing 2-8 bytes of stale memory content to leak to clients and misaligning subsequent data decoding.

Detection Guidance

This vulnerability is specific to the Linux kernel's NFS daemon (nfsd) and involves incorrect XDR padding in flexfile GETDEVICEINFO replies. Detection requires checking kernel logs for NFS-related errors or examining network traffic for malformed NFS responses. Use commands like 'dmesg | grep nfsd' or 'journalctl -u nfs-server' to inspect kernel logs for NFS daemon issues.

Impact Analysis

This flaw could allow attackers to read sensitive memory contents from the NFS server, potentially exposing confidential data. It may also cause client-side decoding errors or crashes when processing NFS responses.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system using your package manager (e.g., 'apt update && apt upgrade' for Debian/Ubuntu or 'yum update' for RHEL-based systems). Restart the NFS service after updating to ensure the patched kernel is active.

Hi! I’m here to help you understand CVE-2026-89673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70