{"id":"CVE-2026-89674","title":"nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in eit…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-805"],"vendor":"Linux","product":"Linux","affected":["Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 3a7fd224df0fbb42167eb1b77be45d72fe0b1098","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 29e4478e2ed5a227e8f0c33cacb91bf227cedd47","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 65a72b721943618eeb3a41c8b36e915591f3f83f","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < bee826c00ac900473f91306f1f3e5a5a81fd4a74","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < e7d9d23ecd9172f05b09bb678ff22db8e361c428","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 0380129b1373c437eb35401a174671c8888f4b80","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < c81cef6a805dec266c10fc4f83c93d6fcf1a2b43","Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < f9868174af49d207fbaf0c5e055d088a983684af","Linux 4.8"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:50:47.609Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89674","references":[{"url":"https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098"},{"url":"https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47"},{"url":"https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f"},{"url":"https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74"},{"url":"https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"},{"url":"https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"},{"url":"https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"},{"url":"https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89674.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89674"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532385"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89674"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89674"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89674.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00514,"epssPercentile":0.43613,"scores":{"cna":9.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89674","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n   writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n   while len's header constant overestimates by 8 bytes -- these\n   partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants.\n\n## Affected\n\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 3a7fd224df0fbb42167eb1b77be45d72fe0b1098`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 29e4478e2ed5a227e8f0c33cacb91bf227cedd47`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 65a72b721943618eeb3a41c8b36e915591f3f83f`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < bee826c00ac900473f91306f1f3e5a5a81fd4a74`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < e7d9d23ecd9172f05b09bb678ff22db8e361c428`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 0380129b1373c437eb35401a174671c8888f4b80`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < c81cef6a805dec266c10fc4f83c93d6fcf1a2b43`\n- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < f9868174af49d207fbaf0c5e055d088a983684af`\n- `Linux 4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89674.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224633,"id":"CVE-2026-89674","ts":1792401445024,"field":"cvss","old":"5.5","new":"9.8"},{"seq":224632,"id":"CVE-2026-89674","ts":1792401445024,"field":"severity","old":"medium","new":"critical"},{"seq":205436,"id":"CVE-2026-89674","ts":1789576713761,"field":"cvss","old":"9.8","new":"5.5"},{"seq":205435,"id":"CVE-2026-89674","ts":1789576713761,"field":"severity","old":"critical","new":"medium"},{"seq":197760,"id":"CVE-2026-89674","ts":1789384318734,"field":"cvss","old":"7.5","new":"9.8"},{"seq":197759,"id":"CVE-2026-89674","ts":1789384318734,"field":"severity","old":"high","new":"critical"},{"seq":183691,"id":"CVE-2026-89674","ts":1789356676968,"field":"cvss","old":"9.8","new":"7.5"},{"seq":183690,"id":"CVE-2026-89674","ts":1789356676968,"field":"severity","old":"critical","new":"high"},{"seq":153540,"id":"CVE-2026-89674","ts":1789285351206,"field":"cvss","old":null,"new":"9.8"},{"seq":153539,"id":"CVE-2026-89674","ts":1789285351206,"field":"severity","old":"none","new":"critical"},{"seq":147297,"id":"CVE-2026-89674","ts":1789270207946,"field":"cvss","old":null,"new":"7.5"},{"seq":147296,"id":"CVE-2026-89674","ts":1789270207946,"field":"severity","old":"none","new":"high"},{"seq":109054,"id":"CVE-2026-89674","ts":1789183730128,"field":"cvss","old":null,"new":"7.5"},{"seq":109053,"id":"CVE-2026-89674","ts":1789183730128,"field":"severity","old":"none","new":"high"}]}