Executive brief
The Linux kernel's NFS server component contains errors in buffer size calculations that can cause memory corruption or information disclosure. When clients request file layout information, the kernel can write beyond allocated memory or expose uninitialized kernel memory to clients, potentially allowing attackers to crash the system or leak sensitive data.
Technical details
The vulnerability is a buffer overrun and information disclosure flaw in the nfsd4_ff_encode_layoutget() function within the NFS server's flex file layout encoder (fs/nfsd/flexfilelayoutxdr.c). The root cause is incorrect XDR (External Data Representation) buffer size calculations for file handles, user IDs, group IDs, and associated metadata. Specifically: (1) file handle length calculation omits XDR padding; (2) uid/gid length calculations use incorrect byte counts (8 + len instead of 4 + xdr_align_size(len)); (3) data server entry length omits flags and stats_collect_hint fields. The worst case occurs with short strings and odd-sized file handles, allowing writes up to 5 bytes past the reserved buffer. An unauthenticated network attacker can trigger this via NFSv4 LAYOUTGET requests without special privileges. The fix corrects all three calculations using explicit field accounting and proper xdr_align_size() application. Patch available in Linux kernel stable trees as of May 2026.
Affected products
- Linux Linux kernel versions affected across linux-3.x through linux-7.x stable series
Timeline
- 2026-05-28: disclosed
- 2026-09-07: patched
- 2026-09-11: advisory