CVE-2026-89673 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
A flaw in the Linux kernel NFS server allows remote attackers to read stale memory contents due to incorrect XDR padding calculations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89673?
CVE-2026-89673 is a vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode.
Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.
Which versions are affected by CVE-2026-89673?
How do I fix CVE-2026-89673?
Apply the vendor's patch.
Is CVE-2026-89673 being exploited?
There is no known exploitation of CVE-2026-89673 in the wild and no public exploit code.
Sources
Also known as AZL-100091, BELL-CVE-2026-89673, GHSA-fpgc-gpfg-74f9, UBUNTU-CVE-2026-89673.