CVE-2017-7895: Debian Linux

Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days.

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Linux Linux Kernel: before 3.2.89 (fixed in 3.2.89); from 3.3, before 3.16.44 (fixed in 3.16.44); from 3.17.0, before 4.1.40 (fixed in 4.1.40); from 4.2, before 4.4.67 (fixed in 4.4.67); from 4.5.0, before 4.9.26 (fixed in 4.9.26); from 4.10, before 4.10.14 (fixed in 4.10.14)

Published 2017-04-28. Last modified 2026-06-17.