Executive brief
The Linux kernel's NFS server (nfsd) contains a bug in how it calculates padding for flexfile GETDEVICEINFO responses. The calculation mismatch causes stale data from reply buffers to be leaked to NFS clients, and can misalign subsequent protocol fields. This affects systems that export flexfile layouts over NFSv4.
Technical details
The vulnerability is an XDR (eXternal Data Representation) encoding error in the nfsd4_ff_encode_getdeviceinfo() function. The code incorrectly calculates the da_addr_body field length as 16 + netid_len + addr_len bytes, but the actual xdr_encode_opaque() function writes 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes due to XDR alignment padding. This mismatch results in 2–8 bytes of declared length exceeding actual encoded data on every flexfile GETDEVICEINFO reply, leaking uninitialized reply-page content to the client and misaligning the version list decode. The fix uses xdr_align_size() to match the actual alignment behavior. Network reachability and NFS client connection are required; no authentication bypass occurs. A patch is available.
Affected products
- Linux Linux kernel multiple versions (patch applied to stable branches 4.14.y through 7.2.y and mainline)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Patch 8b989aaec85e1293a871d602590c951fe44b8647 committed upstream; backported to stable branches