CVE-2026-89674

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has

multiple errors that can result in either an out-of-bounds write or

leaking uninitialized kernel memory to the client:

- fh_len doesn't account for XDR padding on the file handle data

- uid and gid lengths use "8 + len" but xdr_encode_opaque() actually

writes "4 + xdr_align_size(len)" bytes

- ds_len omits the flags and stats_collect_hint fields (8 bytes),

while len's header constant overestimates by 8 bytes -- these

partially cancel but leave a net mismatch

The worst case occurs with short strings (e.g. uid=0, gid=0 with an

odd-sized file handle), where the function writes up to 5 bytes past

the reserved XDR buffer. Conversely, when string lengths happen to be

4-byte aligned, the reservation is too large and stale buffer content

is sent to the client.

Fix this by breaking out

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References