CVE-2026-31402

Vulnerability

Details The NFSv4.0 replay cache in the Linux kernel uses a fixed 112-byte inline buffer to store encoded operation responses. This buffer size was calculated based on OPEN responses and does not account for LOCK denied responses, which can include a variable-length conflicting lock owner field up to 1024 bytes. When a LOCK operation is denied, nfsd4_encode_operation() copies the full encoded response into the undersized buffer via read_bytes_from_xdr_buf() without bounds checking, resulting in a slab-out-of-bounds write of up to 944 bytes past the buffer end [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by using two cooperating NFSv4.0 clients. The first client sets a lock with a large owner string (up to 1024 bytes), and the second client requests a conflicting lock to provoke a denial response. The large owner is then copied into the replay buffer, causing the heap overflow.

Impact

Successful exploitation corrupts adjacent heap memory, potentially leading to system crash or arbitrary code execution. Given the unauthenticated remote attack vector and the critical severity (CVSS 9.8), this vulnerability poses a significant threat to systems running the affected Linux kernel versions.

Mitigation

The fix has been backported to stable kernel trees. Instead of increasing the buffer size (which would waste memory for most lock owners), the patch checks the encoded response length against the buffer capacity. If the response exceeds the limit, the replay caching of the payload is skipped while the status is still cached. Administrators should apply the latest kernel updates from their distribution [2][3][4].