Executive brief
The Linux kernel's NFSv4.2 network filesystem implementation contains a buffer overflow vulnerability in the LAYOUTSTATS encoding routine. A malicious or compromised NFS server can craft responses that cause the kernel to write past the allocated send buffer, potentially triggering a denial of service (system hang or crash) when locking mechanisms are involved.
Technical details
The vulnerability exists in the NFSv4.2 pNFS flexfiles layout driver's LAYOUTSTATS encoding path. The `encode_layoutstats_maxsz` macro allocates only 256 bytes for the layoutupdate4 body, but `ff_layout_encode_ff_layoutupdate()` can emit significantly more data per data server (netaddr4, nfs_fh4, two ff_io_latency4 structures, nfstime4, and a bool). When the server provides a large filehandle (up to NFS_MAXFHSIZE bytes) and network address, the encoder exceeds the buffer. If `xdr_reserve_space()` returns NULL due to buffer exhaustion while the code holds `dss_info->mirror->lock`, the lock is permanently held, leading to system deadlock. The fix increases PNFS_LAYOUTSTATS_MAXSIZE from 256 to 384 bytes to accommodate the maximum possible record size.
Affected products
- Linux Linux kernel All versions with pNFS flexfiles NFSv4.2 support (approximately 4.0 and later)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Fix committed to Linux stable tree