Answer in brief
CVE-2026-89673 records a Unknown severity vulnerability in nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3f1a2b0b2d575f39ff0bedb5411822fe7446a805 <356decf074b82bac5564568203c12426dcea3470 || >=19a648a07572c70fbe16faf0fafaf3dce9fd998a <15460c8e6c9bc92cda8f68bc419ac082300ab3d6 || >=6d08bd22fa2941a4d5ef45ed115dd00e484a93d7 <9be67a6be48ddf2ebaa98c0df671690b8f9666e7 || >=6372e2ee629894433fe6107d7048536a3280a284 <88bce7e326c368d7df15126ccac537e54bebd467 || >=6372e2ee629894433fe6107d7048536a3280a284 <74015b7be806ad9e21d46f7bd2831df280c6c783 || >=6372e2ee629894433fe6107d7048536a3280a284 <41ebca28e17f84293650598f86bd69532ec1a8e0 || >=6372e2ee629894433fe6107d7048536a3280a284 <62e5949f0dd5ec837af144860ff908369df4c7c9 || >=6372e2ee629894433fe6107d7048536a3280a284 <8b989aaec85e1293a871d602590c951fe44b8647 || 82e36f0c287769a0430268739a71dbd56df0e679 || 6370e66a71c4869247f8f406c2a8b2c43df8998f || 16282aeca44bfac0d1ac3be6cd1a719d6ff3d749 || efcae97fa425ca6db9d126e37daccf2d7225cb09 || 64c959d59c24c661bd5338e4e6f1f703d7c309a1 || >=5.10.195 <5.10.270 || >=5.15.132 <5.15.221 || >=6.1.53 <6.1.188 || >=4.14.326 <4.15 || >=4.19.295 <4.20 || >=5.4.257 <5.5 || >=6.4.16 <6.5 || >=6.5.3 <6.6 | 356decf074b82bac5564568203c12426dcea3470, 15460c8e6c9bc92cda8f68bc419ac082300ab3d6, 9be67a6be48ddf2ebaa98c0df671690b8f9666e7, 88bce7e326c368d7df15126ccac537e54bebd467, 74015b7be806ad9e21d46f7bd2831df280c6c783, 41ebca28e17f84293650598f86bd69532ec1a8e0, 62e5949f0dd5ec837af144860ff908369df4c7c9, 8b989aaec85e1293a871d602590c951fe44b8647, 5.10.270, 5.15.221, 6.1.188, 4.15, 4.20, 5.5, 6.5, 6.6 |
| Linux/Linuxgeneric | 6.6 | Not reported |
| Linux/Linuxgeneric | >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <74015b7be806ad9e21d46f7bd2831df280c6c783 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <41ebca28e17f84293650598f86bd69532ec1a8e0 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <62e5949f0dd5ec837af144860ff908369df4c7c9 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <8b989aaec85e1293a871d602590c951fe44b8647 | 74015b7be806ad9e21d46f7bd2831df280c6c783, 41ebca28e17f84293650598f86bd69532ec1a8e0, 62e5949f0dd5ec837af144860ff908369df4c7c9, 8b989aaec85e1293a871d602590c951fe44b8647 |
| Linux/Linuxgeneric | >=6.4.16 <6.12.109 || >=6.4.16 <6.18.50 || >=6.4.16 <7.2.4 || >=6.4.16 <7.3-rc1 | 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 |
| Linux/Linuxgeneric | >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <88bce7e326c368d7df15126ccac537e54bebd467 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <74015b7be806ad9e21d46f7bd2831df280c6c783 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <41ebca28e17f84293650598f86bd69532ec1a8e0 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <62e5949f0dd5ec837af144860ff908369df4c7c9 || >=efcae97fa425ca6db9d126e37daccf2d7225cb09 <8b989aaec85e1293a871d602590c951fe44b8647 | 88bce7e326c368d7df15126ccac537e54bebd467, 74015b7be806ad9e21d46f7bd2831df280c6c783, 41ebca28e17f84293650598f86bd69532ec1a8e0, 62e5949f0dd5ec837af144860ff908369df4c7c9, 8b989aaec85e1293a871d602590c951fe44b8647 |
| Linux/Linuxgeneric | >=6.4.16 <6.6.157 || >=6.4.16 <6.12.109 || >=6.4.16 <6.18.50 || >=6.4.16 <7.2.4 || >=6.4.16 <7.3-rc1 | 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 |
| Linux/Linuxgeneric | >=6.4.16 <6.6.157 || >=6.4.16 <6.12.109 || >=6.4.16 <6.18.50 || >=6.4.16 <7.2.4 || >=6.4.16 <7.3 | 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-aligning the subsequent version list decode. Use xdr_align_size() for each string length to match what xdr_encode_opaque() actually writes.
Quoted source text, attributed separately from HOL analysis.