CVE-2026-89674 Overview
CVE-2026-89674 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The XDR buffer size calculation in nfsd4_ff_encode_layoutget() contains multiple arithmetic errors. These errors can trigger an out-of-bounds write or leak uninitialized kernel memory to a remote NFSv4.1 client.
The flaw affects the Flexible File layout encoding path used when servicing LAYOUTGET operations for pNFS clients. Because NFS is exposed over the network and the miscalculation is reachable during normal protocol handling, exploitation requires no authentication in configurations that expose NFS without access controls.
Critical Impact
A remote client can cause the kernel to write up to 5 bytes past a reserved XDR buffer or receive stale kernel buffer contents, enabling memory corruption or information disclosure.
Affected Products
- Linux kernel builds with CONFIG_NFSD and pNFS Flexible File layout support enabled
- Distribution kernels shipping the vulnerable nfsd4_ff_encode_layoutget() implementation prior to the referenced stable patches
- NFS servers exporting filesystems to pNFS-capable clients
Discovery Timeline
- 2026-09-11 - CVE-2026-89674 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89674
Vulnerability Analysis
The defect lives in nfsd4_ff_encode_layoutget(), which encodes the Flexible File pNFS layout response returned to clients. The function reserves an XDR buffer sized by adding several length constants for the file handle, user ID, group ID, and data server fields. Multiple constants used in that sum are incorrect.
First, fh_len does not account for XDR 4-byte padding on the file handle payload. Second, the uid and gid lengths are computed as 8 + len, but xdr_encode_opaque() actually writes 4 + xdr_align_size(len) bytes. Third, ds_len omits the 8 bytes needed for the flags and stats_collect_hint fields while the header constant overestimates by 8 bytes, producing a net mismatch.
When encoded strings are short and the file handle length is odd, the encoder writes up to 5 bytes beyond the reserved region. When the string lengths happen to be 4-byte aligned, the reservation is larger than the encoded content and unwritten kernel buffer memory is transmitted to the client. Both paths originate from the same miscalculation.
Root Cause
The root cause is an incorrect length calculation combined with inconsistent handling of XDR alignment. The reservation math relies on hardcoded per-field constants that do not match what the underlying xdr_encode_opaque() helper actually emits. This is a classic boundary condition and uninitialized memory use pattern in a network-facing encoder.
Attack Vector
The attack vector is network-based. A pNFS client issuing LAYOUTGET operations triggers the vulnerable encoding path on the server. The attacker controls conditions such as file handle length and identifier lengths through the exported filesystem state, which determines whether the miscalculation results in an out-of-bounds write or in stale memory disclosure to the client.
No verified proof-of-concept code has been published. The Linux kernel maintainers describe the corruption and disclosure behavior in the commit messages linked from the NVD entry.
Detection Methods for CVE-2026-89674
Indicators of Compromise
- Unexpected nfsd kernel warnings, KASAN reports, or slab corruption traces on NFS servers handling pNFS LAYOUTGET requests
- NFSv4.1 clients receiving layout responses containing non-deterministic bytes in file handle, uid, gid, or data server fields
- Kernel panics or nfsd thread crashes correlated with Flexible File layout traffic from untrusted clients
Detection Strategies
- Inventory Linux hosts running nfsd with pNFS Flexible File layouts enabled and compare kernel versions against the fixed commits listed on git.kernel.org
- Enable KASAN or KFENCE on test kernels to catch the out-of-bounds write in nfsd4_ff_encode_layoutget() before production exposure
- Monitor NFS server logs and dmesg for slab-out-of-bounds or use-after-free style diagnostics tied to the nfsd module
Monitoring Recommendations
- Capture and baseline NFSv4.1 LAYOUTGET request volume per client to identify anomalous polling or malformed request patterns
- Alert on new or unexpected clients reaching TCP/2049 on servers that should only serve internal pNFS consumers
- Forward kernel telemetry from NFS servers to a centralized data lake for correlation with client identity and network context
How to Mitigate CVE-2026-89674
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the NVD entry and reboot affected NFS servers
- Restrict NFS server exposure to trusted client networks using host firewalls and network ACLs on TCP/UDP 2049
- Audit /etc/exports and pNFS configuration to confirm Flexible File layouts are only served to authorized clients
Patch Information
The fix rewrites the ds_len calculation to enumerate every encoded field explicitly, uses xdr_align_size() for all variable-length opaque fields, and corrects the header constants. Backports are available in the following stable kernel commits: Kernel Patch 0380129b, Kernel Patch 29e4478e, Kernel Patch 3a7fd224, Kernel Patch 65a72b72, Kernel Patch bee826c0, Kernel Patch c81cef6a, Kernel Patch e7d9d23e, and Kernel Patch f9868174.
Workarounds
- Disable pNFS Flexible File layouts on the server and fall back to legacy NFSv4.0 or NFSv4.1 without layout delegation until patches are deployed
- Block untrusted networks from reaching the NFS server ports using upstream firewalls or Kubernetes network policies
- Require Kerberos authentication (sec=krb5, krb5i, or krb5p) on NFS exports to limit which clients can invoke LAYOUTGET
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.