CVE-2026-89673 Linux CVE debrief

Who should care

Linux kernel maintainers, users of nfsd, and administrators of systems utilizing the Linux kernel, especially in environments where nfsd is deployed, should assess their exposure to this vulnerability and apply patches as necessary.

Why it matters

This vulnerability in the Linux kernel's nfsd component requires attention from maintainers and users to prevent potential information leaks and ensure correct nfsd functionality. The issue is related to XDR padding calculation in the ff_encode_getdeviceinfo function, affecting how data is encoded and potentially exposing stale reply-page content to clients.

• Potential exposure of stale data to clients due to incorrect XDR padding calculation.
• Mis-alignment of subsequent version list decodes following affected nfsd responses.
• Necessity to review and apply patches to prevent potential information leaks and ensure correct functionality of nfsd.
• Verification of Linux kernel versions and updates to patched versions to mitigate the vulnerability.

Technical summary

The Linux kernel nfsd component has a vulnerability related to XDR padding calculation in the ff_encode_getdeviceinfo function. This issue could lead to exposure of stale reply-page content to clients and incorrect alignment of subsequent version list decodes. The problem arises from a mismatch between the declared and actual length of data encoded in flexfile GETDEVICEINFO replies. The vulnerability requires attention from Linux kernel maintainers and users, especially those utilizing nfsd, to assess exposure and apply patches. The affected product context and defensive impact should be considered when reviewing and applying patches.

Defensive priority

Medium priority for Linux kernel maintainers and users, especially those utilizing nfsd, to assess exposure and apply patches.

Recommended defensive actions

• Review and apply patches for the Linux kernel, specifically for nfsd, to fix the XDR padding calculation issue.
• Assess exposure by checking the versions of the Linux kernel in use, particularly versions prior to the patched ones.
• Update Linux kernel versions to 5.10.270, 5.15.221, 6.1.188, or later as recommended by the vendor.
• Monitor for potential mis-alignment issues in nfsd responses and verify the integrity of data exchanged with clients.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its description and affected versions. Multiple source references are available, pointing to specific commits in the Linux kernel repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.