CVE-2026-90103: Linux Vulnerability (CVSS 7.5)

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that. ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4 and the bool add a further 144, so the body passes 256 bytes before the netaddr4 is encoded at all. encode_layoutstats() additionally writes the deviceid4 and the layoutupdate4 lou_type word, neither of which the macro accounts for. The filehandle and the address are both chosen by the server, through LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the end of the send buffer. xdr_reserve_space() returns NULL once that happens, and the two ff_layout_encode_io_latency() calls run with dss_info->mirror->lock held, so a NULL return there leaves the lock permanently held. Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the reservation.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < 842ac26615424577f24f0486b9d3bf97f28fad9c; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < 397aa7000bbf6b6a0d32e66a544e978fb478c8e4; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < e82d7d999fe9f893f84bf332fd39cb5d9de7128f; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < 5aca000630c0fd0da102ae1abf9245dd74f2ce36; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < cb11590c7ddc6883a1b1d70b1f98b2779fe626f2; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < 3815b894b922e9b4f40b8b6f6d67bf80d44141c9; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < a973622da0c62c34043ddbbf382cd761b03e5136; >= 27c430644369ccd9a2272492ba6d0e85e2e4800b, < c75ef2137e749f2673f0617cfdaae53b2bb7195a
Linux	Linux	4.2

References

Timeline

Published: Sep 17, 2026
Last Modified: Sep 18, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-90103?

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE), i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that. ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4, an nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server whose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of those bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4 and the bool add a further 144, so the body passes 256 bytes before the netaddr4 is encoded at all. encode_layoutstats() additionally writes the deviceid4 and the layoutupdate4 lou_type word, neither of which the macro accounts for. The filehandle and the address are both chosen by the server, through LAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the end of the send buffer. xdr_reserve_space() returns NULL once that happens, and the two ff_layout_encode_io_latency() calls run with dss_info->mirror->lock held, so a NULL return there leaves the lock permanently held. Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the reservation.

How severe is CVE-2026-90103?

CVE-2026-90103 has a CVSS score of 7.5/10 (HIGH severity).

How do I fix CVE-2026-90103?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →