Executive brief
libnfs is a client library used by applications to communicate with Network File System (NFS) storage. A vulnerability exists where a malicious or compromised NFS server can send specially crafted data that causes the library to malfunction. This could allow an attacker to gain unauthorized access to data or cause the application using the library to crash or behave unpredictably.
Technical details
An integer underflow vulnerability exists in libnfs through version 6.0.2 within the `READ_IOVEC` case of `rpc_read_from_socket` in `lib/socket.c`. The flaw occurs when the expected PDU size exceeds the absolute PDU size derived from the XID/record-marker, leading to a negative result when subtracting `rpc->pdu_size` from `rpc->rm_xid[0]`. An attacker controlling a malicious NFS server can exploit this during a connection to trigger the underflow. This can result in out-of-bounds memory operations. The issue was addressed in commit 935b8db by adding a check to ensure `rpc->rm_xid[0]` is not smaller than `rpc->pdu_size` before subtraction.
Affected products
- sahlberg libnfs through 6.0.2 before commit 935b8db
Timeline
- 2026-06-26: advisory: NVD publication date
- 2026-06-26: disclosed: CVE published by MITRE