Linux NFS server (nfsd, nfssvc_decode_writeargs): The NFSv2/v3 write argument decoder has no lower bound on the length

Impact

The NFSv2/v3 write argument decoder has no lower bound on the length field, so a negative value underflows and the server reads or writes outside the intended buffer. Unauthenticated remote memory corruption in the kernel on the file server.

Who can reach it

Any host able to send NFS RPC to the server. No authentication needed.

What to do

Update the storage server kernel and reboot. If your workloads only need NFSv4, disable v2/v3 in /etc/nfs.conf (vers2=n, vers3=n) to remove this decoder from the reachable surface.

References