libnfs: unvalidated string size causes an integer overflow when connecting to a crafted NFS server

Impact

libnfs_zdr_string does not validate a string size, so a malicious or compromised NFS server can overflow an integer in a client that connects to it. The exposure is client-side: it matters where userspace NFS clients built on libnfs reach out to servers you do not fully control - QEMU's NFS block backend, backup and media tooling, utilities bundled into node images. It does not affect the in-kernel NFS client, and a fleet that only mounts its own storage over the kernel client is not exposed through this path. The record gives no exploitation detail beyond the integer overflow; CVSS rates confidentiality and integrity impact high with high attack complexity and required interaction.

Who can reach it

The client must connect to a server the attacker controls, so this needs either a hostile NFS endpoint or an on-path attacker plus whatever action triggers the connection. No authentication on the client side is involved.

What to do

Update libnfs past commit 55c18ea (releases through 6.0.2 are affected) and restart anything linked against it - for a distro package that means the usual package update plus restarting consumers such as QEMU processes, which for running VMs implies a live-migrate or a restart. Debian LTS has shipped an update. Meanwhile, restrict which NFS servers nodes are allowed to reach.

References

Related entries

• RabbitMQ: super-stream binding-keys parsed before the permission check, one PUT kills the nodeCVE-2026-67408 · RabbitMQ (rabbitmq_stream_management super-stream binding-keys handler)High
• Jenkins Ivy Report Plugin: XXE in Ivy report parsing gives an authenticated user file read on the controllerCVE-2026-70448 · Jenkins Ivy Report Plugin (XML parser for Ivy report files)High
• Apache DolphinScheduler: non-admin users can read admin-managed kubeconfig credentialsCVE-2026-71895 · Apache DolphinScheduler (Kubernetes cluster configuration API)High
• Determined AI (master API, generic task kill/pause/unpause handlers): The generic task kill, pause and unpauseCVE-2026-75109 · Determined AI (master API, generic task kill/pause/unpause handlers)High
• Jenkins ThinBackup plugin: attacker redirects backups and pulls arbitrary controller files into themCVE-2026-84667 · Jenkins ThinBackup plugin (backup configuration writable via Stapler data binding)High
• automation-controller: sanitize_jinja bypass lets a low-privileged user run Jinja in the execution environmentCVE-2026-84714 · Red Hat Ansible Automation Platform automation-controller (sanitize_jinja input guard)High