Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply buffer

Impact

The XDR reservation in nfsd4_ff_encode_layoutget() does not match what the encoder actually writes: the file handle padding is unaccounted, uid/gid opaque lengths are over-counted, and the ds_len constants are wrong. With short uid/gid strings and an odd-sized file handle the encoder writes up to 5 bytes past the reserved buffer; with 4-byte-aligned strings the reservation is too large and uninitialised reply-page content is sent to the client. On a GPU cluster this is the shared dataset and checkpoint server: any client that can request a pNFS flexfiles layout can corrupt kernel memory adjacent to the reply buffer or read back stale kernel page content. Only servers exporting pNFS flexfiles layouts reach this code.

Who can reach it

Any host that can mount the export and issue an NFSv4.1+ LAYOUTGET against a pNFS flexfiles layout. Standard NFS export authentication applies; no local access to the server is needed.

What to do

Upgrade to a stable kernel containing the referenced commits and reboot the NFS server. Serving nodes must be drained or failed over first - knfsd cannot be restarted in place to pick up a kernel fix. Operators who do not export pNFS flexfiles layouts are not affected and can defer to their normal kernel cycle. No fixed version numbers are given in the record, only the stable commits.

References

Related entries

• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-005-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored