CVE-2022-26496: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Network Block Device Project Network Block Device: before 3.24 (fixed in 3.24)

Published 2022-03-06. Last modified 2026-06-17.