CVE-2026-89673: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode. Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.

Affected products

• Linux Linux: from 6.4.16, before 6.6.157 (fixed in 6.6.157); from 6.4.16, before 6.12.109 (fixed in 6.12.109); from 6.4.16, before 6.18.50 (fixed in 6.18.50); from 6.4.16, before 7.2.4 (fixed in 7.2.4); from 6.4.16, before 7.3-rc1 (fixed in 7.3-rc1)

Published 2026-09-11. Last modified 2026-09-14.