Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client: - fh_len doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually writes "4 + xdr_align_size(len)" bytes - ds_len omits the flags and stats_collect_hint fields (8 bytes), while len's header constant overestimates by 8 bytes -- these partially cancel but leave a net mismatch The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client. Fix this by breaking out every encoded field explicitly in the ds_len calculation, using xdr_align_size() for all variable-length opaque fields, and correcting the header constants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:54.013Z",
  "pubdate": "2026-09-11T20:19:54.013Z",
  "executiveSummary": "The Linux kernel nfsd component contains a critical XDR buffer size calculation vulnerability within the nfsd4_ff_encode_layoutget function. This flaw, stemming from incorrect alignment and length arithmetic, leads to out-of-bounds memory writes or information disclosure of sensitive kernel memory.\nThe vulnerability type is classified as an improper buffer size calculation leading to memory corruption. Impacted systems include those utilizing NFSv4 with Flex File layout support. Successful exploitation allows an attacker to corrupt kernel memory, potentially leading to system instability, crashes, or the unauthorized leakage of uninitialized kernel stack memory to a remote client.\nExploitation requires the ability to interact with the nfsd service over the network. The vulnerability is triggered during the marshaling of the layout response, specifically when handling variable-length opaque fields such as file handles, UIDs, and GIDs. Because the calculated reservation size does not accurately reflect the actual data written by xdr_encode_opaque, the kernel either overflows the allocated buffer or leaves uninitialized padding bytes, which are then transmitted over the wire to the requester.",
  "technicalDetails": "The root cause of the vulnerability lies in nfsd4_ff_encode_layoutget, where the XDR buffer allocation is mismatched with the subsequent data encoding operations. The NFSv4 protocol requires strict XDR padding and alignment; however, the implementation incorrectly calculates these offsets.\nSpecifically, the calculation for fh_len fails to account for necessary XDR padding required for file handle data, causing the encoded stream to be offset incorrectly. Furthermore, the handling of UID and GID lengths utilizes an erroneous '8 + len' arithmetic, whereas the actual encoding function, xdr_encode_opaque(), writes '4 + xdr_align_size(len)' bytes. This discrepancy creates a mismatch between the reserved buffer space and the actual data payload. Additionally, the ds_len calculation fails to account for the mandatory 8-byte footprint of the flags and stats_collect_hint fields, leading to further header constant inaccuracies.\nThe attack flow proceeds as follows: 1. A remote client sends a layoutget request that triggers the Flex File (ff) layout encoding path in the nfsd server. 2. The kernel initializes an XDR buffer based on the flawed length calculation. 3. As the function encodes the file handle, UID, and GID fields, the actual write operation proceeds to append data to the XDR stream. 4. If the string lengths are not 4-byte aligned, the function writes up to 5 bytes beyond the boundary of the reserved buffer, resulting in an out-of-bounds write. Conversely, if the reservation is larger than the actual payload, the XDR stream captures 'stale' or uninitialized kernel memory present in the buffer previously used by the kernel stack or heap.\nThis vulnerability is particularly dangerous because it bypasses conventional memory safety checks by exploiting logic errors in protocol marshaling. The post-exploitation impact includes the potential for remote kernel memory disclosure—which may leak sensitive pointers, cryptographic keys, or credentials—or kernel panic if the out-of-bounds write corrupts critical adjacent memory structures."
}