---
id: CVE-2026-89674
title: 'nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

  The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
  multiple errors that can result in eit…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-805
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    3a7fd224df0fbb42167eb1b77be45d72fe0b1098
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    29e4478e2ed5a227e8f0c33cacb91bf227cedd47
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    65a72b721943618eeb3a41c8b36e915591f3f83f
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    bee826c00ac900473f91306f1f3e5a5a81fd4a74
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    e7d9d23ecd9172f05b09bb678ff22db8e361c428
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    0380129b1373c437eb35401a174671c8888f4b80
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    c81cef6a805dec266c10fc4f83c93d6fcf1a2b43
  - >-
    Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 <
    f9868174af49d207fbaf0c5e055d088a983684af
  - Linux 4.8
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:47.609Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89674'
references:
  - url: 'https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098'
  - url: 'https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47'
  - url: 'https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f'
  - url: 'https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74'
  - url: 'https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428'
  - url: 'https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80'
  - url: 'https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43'
  - url: 'https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89674.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89674'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532385'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89674'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89674'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89674.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00514
epssPercentile: 0.43613
scores:
  cna: 9.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
multiple errors that can result in either an out-of-bounds write or
leaking uninitialized kernel memory to the client:

 - fh_len doesn't account for XDR padding on the file handle data
 - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually
   writes "4 + xdr_align_size(len)" bytes
 - ds_len omits the flags and stats_collect_hint fields (8 bytes),
   while len's header constant overestimates by 8 bytes -- these
   partially cancel but leave a net mismatch

The worst case occurs with short strings (e.g. uid=0, gid=0 with an
odd-sized file handle), where the function writes up to 5 bytes past
the reserved XDR buffer. Conversely, when string lengths happen to be
4-byte aligned, the reservation is too large and stale buffer content
is sent to the client.

Fix this by breaking out every encoded field explicitly in the ds_len
calculation, using xdr_align_size() for all variable-length opaque
fields, and correcting the header constants.

## Affected

- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 3a7fd224df0fbb42167eb1b77be45d72fe0b1098`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 29e4478e2ed5a227e8f0c33cacb91bf227cedd47`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 65a72b721943618eeb3a41c8b36e915591f3f83f`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < bee826c00ac900473f91306f1f3e5a5a81fd4a74`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < e7d9d23ecd9172f05b09bb678ff22db8e361c428`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < 0380129b1373c437eb35401a174671c8888f4b80`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < c81cef6a805dec266c10fc4f83c93d6fcf1a2b43`
- `Linux >= 9b9960a0ca4773e21c4b153ed355583946346b25 < f9868174af49d207fbaf0c5e055d088a983684af`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89674.json)