Look up another CVE · open CVE-2026-90103 in the interactive tracker
CVE-2026-90103
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem include/linux. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90103 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that. ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4 and the bool add a further 144, so the body passes 256 bytes before the netaddr4 is encoded at all. encode_layoutstats() additionally writes the deviceid4 and the layoutupdate4 lou_type word, neither of which the macro accounts for. The filehandle and the address are both chosen by the server, through LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the end of the send buffer. xdr_reserve_space() returns NULL once that happens, and the two ff_layout_encode_io_latency() calls run with dss_info->mirror->lock held, so a NULL return there leaves the lock permanently held. Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the reservation.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/linux/nfs_xdr.h
- What this is
- NFS, SUNRPC, AND LOCKD CLIENTSMAINTAINERS section matched on include/linux/nfs* · linux-nfs@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.70%, higher than 52.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/linux
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.2 | 5.10.270 | 842ac2661542 |
| 4.2 | 5.15.221 | 397aa7000bbf |
| 4.2 | 6.1.188 | e82d7d999fe9 |
| 4.2 | 6.6.157 | 5aca000630c0 |
| 4.2 | 6.12.110 | cb11590c7ddc |
| 4.2 | 6.18.52 | 3815b894b922 |
| 4.2 | 7.2.6 | a973622da0c6 |
| 4.2 | 7.3 | c75ef2137e74 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The oversized nfs_fh4 and netaddr4 that exhaust the LAYOUTSTATS send buffer are taken from the MDS LAYOUTGET flexfiles blob (decode_nfs_fh in ff_layout_alloc_lseg) and GETDEVICEINFO body (nfs4_decode_mp_ds_addr via nfs4_ff_alloc_deviceid_node), delivered over NFSv4 RPC/TCP.
- AC:LAttack complexity, low
- decode_nfs_fh accepts a server-chosen fh->size up to NFS_MAXFHSIZE, and ff_layout_mirror_prepare_stats encodes up to PNFS_LAYOUTSTATS_MAXDEV mirrors, so a hostile MDS can make nfs4_xdr_enc_layoutstats exceed encode_layoutstats_maxsz with no race or rare config.
- PR:NPrivileges required, none
- The attacker is the NFSv4.2 pNFS metadata server that returns the LAYOUTGET/GETDEVICEINFO bodies; no local account, capability, or user-namespace privilege on the victim client is required once the flexfiles session exists.
- UI:NUser interaction, none
- On a pre-mounted NFSv4.2 flexfiles share (fstab, autofs, HPC/NAS), ordinary I/O hits nfs4_ff_layout_stat_io_start_read/write, and the MDS also sets report_interval in the LAYOUTGET blob so pnfs_report_layoutstat runs without further interactive victim action.
- S:UScope, unchanged
- The NULL dereference and stuck dss_info->mirror->lock occur in the NFS client LAYOUTSTATS encoder on the same host; this is not a VM escape, container breakout, or IOMMU/DMA boundary crossing.
- C:NConfidentiality impact, none
- Once the send buffer is exhausted, xdr_reserve_space() returns NULL and ff_layout_encode_io_latency/xdr_encode_opaque dereference it; that is a fault, not an out-of-bounds read or use-after-free that would disclose kernel memory.
- I:NIntegrity impact, none
- xdr_get_next_encode_buffer refuses reservations that would exceed rq_snd_buf.buflen, so the encoder does not write past the RPC send buffer into adjacent objects; the subsequent NULL stores fault rather than providing a kernel write primitive.
- A:HAvailability impact, high
- nfs4_xdr_enc_layoutstats then either BUG_ONs in reserve_space() or NULL-dereferences in ff_layout_encode_io_latency while holding dss_info->mirror->lock, oopsing the client and leaving that spinlock permanently taken so further flexfiles I/O hangs.