CVE-2026-89673 Overview
CVE-2026-89673 is an information disclosure vulnerability in the Linux kernel NFS server (nfsd). The flaw resides in nfsd4_ff_encode_getdeviceinfo(), which handles flexfile layout GETDEVICEINFO replies for NFSv4.1 pNFS clients. The function reserves space using raw string lengths but the underlying xdr_encode_opaque() calls emit values padded to 4-byte boundaries. This mismatch causes the declared da_addr_body length to exceed the actual encoded data by 2 to 8 bytes on every reply. As a result, the kernel transmits stale reply-page content to clients and misaligns the subsequent version list decode.
Critical Impact
Every flexfile GETDEVICEINFO response leaks 2–8 bytes of stale kernel reply-page memory to any NFSv4.1 client and corrupts XDR stream alignment for downstream fields.
Affected Products
- Linux kernel with NFSD flexfile pNFS support enabled
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- NFSv4.1 servers exporting pNFS flexfile layouts to remote clients
Discovery Timeline
- 2026-09-11 - CVE-2026-89673 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89673
Vulnerability Analysis
The defect is an XDR (External Data Representation) padding accounting bug in the kernel NFS server. XDR encodes variable-length opaque strings as a 4-byte length prefix followed by the data rounded up to a 4-byte boundary. The nfsd4_ff_encode_getdeviceinfo() function reserves buffer space using unpadded string lengths, while the subsequent xdr_encode_opaque() calls write padded lengths. This discrepancy classifies as an information exposure through sent data [CWE-200] combined with an out-of-bounds read of adjacent reply-page memory.
The leaked bytes originate from whatever previously occupied the reply page buffer. Content varies per request but consistently exposes small windows of kernel memory to any authenticated NFSv4.1 client requesting flexfile device information.
Root Cause
The function computes the reservation as 16 + netid_len + addr_len. The actual bytes written total 8 + round_up(netid_len, 4) + round_up(addr_len, 4). The declared da_addr_body opaque length therefore overstates the true payload by 2 to 8 bytes. The fix replaces raw length arithmetic with xdr_align_size() for each string, matching the padding that xdr_encode_opaque() actually emits.
Attack Vector
An NFSv4.1 client with access to a pNFS flexfile export issues a standard GETDEVICEINFO operation. The server responds with the malformed reply containing trailing bytes drawn from the kernel reply page. No authentication bypass or protocol abuse is required — normal client operation triggers the leak on every applicable reply.
The vulnerability mechanics involve XDR padding arithmetic inside nfsd4_ff_encode_getdeviceinfo(). See the referenced Linux kernel commits for the exact patch diffs: Commit 41ebca2, Commit 62e5949, and Commit 88bce7e.
Detection Methods for CVE-2026-89673
Indicators of Compromise
- Client-side XDR decode errors or unexpected trailing bytes appearing after the da_addr_body field in GETDEVICEINFO replies.
- NFSv4.1 clients logging version list decode failures immediately following flexfile device info responses.
- Wire captures showing declared opaque lengths that exceed the actual netid and address string sizes by 2–8 bytes.
Detection Strategies
- Inventory Linux hosts running nfsd with pNFS flexfile layouts enabled and compare running kernel versions against the fixed stable releases.
- Capture NFSv4.1 traffic with tcpdump or wireshark and inspect GETDEVICEINFO responses for length mismatches in device_addr4 structures.
- Run kernel version audits across the fleet and flag any host whose kernel predates the referenced stable commits.
Monitoring Recommendations
- Alert on newly deployed NFS servers advertising flexfile layouts without a confirmed patched kernel.
- Track NFS export changes through configuration management to identify systems that begin serving pNFS after deployment.
- Aggregate kernel package update events into a central data lake to confirm patch propagation across all NFS servers.
How to Mitigate CVE-2026-89673
Immediate Actions Required
- Apply the vendor-supplied kernel update that includes the nfsd XDR padding fix on all NFS servers.
- Restrict NFSv4.1 flexfile access to trusted client networks until patching completes.
- Audit which exports advertise pNFS flexfile layouts and disable the layout type on servers that do not require it.
Patch Information
The fix has been merged into the mainline Linux kernel and backported to stable branches. Reference the upstream commits for the exact code change: Commit 74015b7 and Commit 8b989aa. Apply the corresponding stable kernel release from your distribution vendor.
Workarounds
- Disable pNFS flexfile layouts on affected exports and force clients to fall back to standard NFSv4.1 semantics.
- Limit NFSv4.1 access via firewall rules or export ACLs to reduce the exposed client population.
- Where feasible, downgrade exports to NFSv4.0, which does not invoke the vulnerable GETDEVICEINFO code path.
Refer to distribution-specific kernel update instructions rather than manual reconfiguration whenever patched packages are available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.