Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memory

Impact

nfsd4_ff_encode_getdeviceinfo() declares a da_addr_body length of 16 + netid_len + addr_len while the xdr_encode_opaque() calls emit the 4-byte-aligned form, so the declared length exceeds the encoded data by 2 to 8 bytes on every flexfile GETDEVICEINFO reply. The surplus is stale reply-page content sent to the client, and it mis-aligns the client's decode of the version list that follows. This is a small but repeatable kernel memory disclosure from the shared storage server to any client that can ask for device info, and it only affects servers exporting pNFS flexfiles layouts.

Who can reach it

Any client that can mount the export and issue NFSv4.1+ GETDEVICEINFO for a flexfiles layout, under normal export authentication.

What to do

Upgrade to a stable kernel with the referenced commits and reboot the NFS server after draining clients. Not exploitable on servers that do not export pNFS flexfiles layouts. No fixed version numbers are stated in the record.

References

Related entries

• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored
• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored