---
id: CVE-2026-89673
title: 'nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

  nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation
  as 16 + netid_len + addr_len, but th…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3f1a2b0b2d575f39ff0bedb5411822fe7446a805 <
    356decf074b82bac5564568203c12426dcea3470
  - >-
    Linux >= 19a648a07572c70fbe16faf0fafaf3dce9fd998a <
    15460c8e6c9bc92cda8f68bc419ac082300ab3d6
  - >-
    Linux >= 6d08bd22fa2941a4d5ef45ed115dd00e484a93d7 <
    9be67a6be48ddf2ebaa98c0df671690b8f9666e7
  - >-
    Linux >= 6372e2ee629894433fe6107d7048536a3280a284 <
    88bce7e326c368d7df15126ccac537e54bebd467
  - >-
    Linux >= 6372e2ee629894433fe6107d7048536a3280a284 <
    74015b7be806ad9e21d46f7bd2831df280c6c783
  - >-
    Linux >= 6372e2ee629894433fe6107d7048536a3280a284 <
    41ebca28e17f84293650598f86bd69532ec1a8e0
  - >-
    Linux >= 6372e2ee629894433fe6107d7048536a3280a284 <
    62e5949f0dd5ec837af144860ff908369df4c7c9
  - >-
    Linux >= 6372e2ee629894433fe6107d7048536a3280a284 <
    8b989aaec85e1293a871d602590c951fe44b8647
  - Linux 82e36f0c287769a0430268739a71dbd56df0e679
  - Linux 6370e66a71c4869247f8f406c2a8b2c43df8998f
  - Linux 16282aeca44bfac0d1ac3be6cd1a719d6ff3d749
  - Linux efcae97fa425ca6db9d126e37daccf2d7225cb09
  - Linux 64c959d59c24c661bd5338e4e6f1f703d7c309a1
  - Linux >= 5.10.195 < 5.10.270
  - Linux >= 5.15.132 < 5.15.221
  - Linux >= 6.1.53 < 6.1.188
  - Linux >= 4.14.326 < 4.15
  - Linux >= 4.19.295 < 4.20
  - Linux >= 5.4.257 < 5.5
  - Linux >= 6.4.16 < 6.5
  - Linux >= 6.5.3 < 6.6
  - Linux 6.6
published: '2026-09-11'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:15:11.211Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89673'
references:
  - url: 'https://git.kernel.org/stable/c/356decf074b82bac5564568203c12426dcea3470'
  - url: 'https://git.kernel.org/stable/c/15460c8e6c9bc92cda8f68bc419ac082300ab3d6'
  - url: 'https://git.kernel.org/stable/c/9be67a6be48ddf2ebaa98c0df671690b8f9666e7'
  - url: 'https://git.kernel.org/stable/c/88bce7e326c368d7df15126ccac537e54bebd467'
  - url: 'https://git.kernel.org/stable/c/74015b7be806ad9e21d46f7bd2831df280c6c783'
  - url: 'https://git.kernel.org/stable/c/41ebca28e17f84293650598f86bd69532ec1a8e0'
  - url: 'https://git.kernel.org/stable/c/62e5949f0dd5ec837af144860ff908369df4c7c9'
  - url: 'https://git.kernel.org/stable/c/8b989aaec85e1293a871d602590c951fe44b8647'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89673.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89673'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532322'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89673'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89673'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89673.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00216
epssPercentile: 0.12005
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation
as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque()
calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes.
The mismatch means the declared da_addr_body length exceeds the actual
encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply,
leaking stale reply-page content to the client and mis-aligning the
subsequent version list decode.

Use xdr_align_size() for each string length to match what
xdr_encode_opaque() actually writes.

## Affected

- `Linux >= 3f1a2b0b2d575f39ff0bedb5411822fe7446a805 < 356decf074b82bac5564568203c12426dcea3470`
- `Linux >= 19a648a07572c70fbe16faf0fafaf3dce9fd998a < 15460c8e6c9bc92cda8f68bc419ac082300ab3d6`
- `Linux >= 6d08bd22fa2941a4d5ef45ed115dd00e484a93d7 < 9be67a6be48ddf2ebaa98c0df671690b8f9666e7`
- `Linux >= 6372e2ee629894433fe6107d7048536a3280a284 < 88bce7e326c368d7df15126ccac537e54bebd467`
- `Linux >= 6372e2ee629894433fe6107d7048536a3280a284 < 74015b7be806ad9e21d46f7bd2831df280c6c783`
- `Linux >= 6372e2ee629894433fe6107d7048536a3280a284 < 41ebca28e17f84293650598f86bd69532ec1a8e0`
- `Linux >= 6372e2ee629894433fe6107d7048536a3280a284 < 62e5949f0dd5ec837af144860ff908369df4c7c9`
- `Linux >= 6372e2ee629894433fe6107d7048536a3280a284 < 8b989aaec85e1293a871d602590c951fe44b8647`
- `Linux 82e36f0c287769a0430268739a71dbd56df0e679`
- `Linux 6370e66a71c4869247f8f406c2a8b2c43df8998f`
- `Linux 16282aeca44bfac0d1ac3be6cd1a719d6ff3d749`
- `Linux efcae97fa425ca6db9d126e37daccf2d7225cb09`
- `Linux 64c959d59c24c661bd5338e4e6f1f703d7c309a1`
- `Linux >= 5.10.195 < 5.10.270`
- `Linux >= 5.15.132 < 5.15.221`
- `Linux >= 6.1.53 < 6.1.188`
- `Linux >= 4.14.326 < 4.15`
- `Linux >= 4.19.295 < 4.20`
- `Linux >= 5.4.257 < 5.5`
- `Linux >= 6.4.16 < 6.5`
- `Linux >= 6.5.3 < 6.6`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89673.json)