Description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git era, NFSD has conserved the number of pages
held by each nfsd thread by combining the RPC receive and send
buffers into a single array of pages. This works because there are
no cases where an operation needs a large RPC Call message and a
large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates
svc_rqst::rq_res to describe the part of rq_pages that can be
used for constructing the Reply. This means that the send buffer
(rq_res) shrinks when the received RPC record containing the RPC
Call is large.
A client can force this shrinkage on TCP by sending a correctly-
formed RPC Call header contained in an RPC record that is
excessively large. The full maximum payload size cannot be
constructed in that case.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.19 | 5.10.220 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.3-1 | — |
| Debian 13 | linux | 6.0.3-1 | — |
| Debian 12 | linux | 6.0.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-intel +9 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-56.62 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1026.30 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1029.36 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1029.36.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1025.32 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1023.28 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1011.15 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1021.24 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1021.26 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1024.29 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1015.15 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1025.31 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1021.23 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 +1 | 5.15.0-1026.30~20.04.2 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1029.36~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1025.32~20.04.2 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-56.62~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1021.26~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1025.31~20.04.2 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1028.31 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +10 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.0.0-284.11.1.el9_2 | RHSA-2023:2458 |
| RHEL 9 | perf +48 | 5.14.0-284.11.1.el9_2 | RHSA-2023:2458 |
| RHEL 8 | perf +26 | 4.18.0-425.13.1.el8_7 | RHSA-2023:2951, RHSA-2023:0832 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Rt Els 7 | kernel-rt +7 | 3.10.0-1160.144.1.rt56.1296.el7 | RHSA-2025:23960 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.170.1.el8_6 | RHSA-2025:22006 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.170.1.el8_6 | RHSA-2025:22006 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.170.1.el8_6 | RHSA-2025:22006 |
| RHEL 8.4 EUS Long Life | perf +17 | 4.18.0-305.179.1.el8_4 | RHSA-2025:22752 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.179.1.el8_4 | RHSA-2025:22752 |
| RHEL 8.2 AUS | perf +17 | 4.18.0-193.178.1.el8_2 | RHSA-2025:23445 |
| RHEL 7 ELS | perf +18 | 3.10.0-1160.144.1.el7 | RHSA-2025:23947 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.275.1 | SUSE-SU-2025:03614-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLES for SAP 15 SP3 | kernel-docs +5 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.109.1 | SUSE-SU-2025:3761-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2025:3716-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.133.1 | SUSE-SU-2025:3716-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.223.1 | SUSE-SU-2025:03613-1 |
| SLE Micro 5.1 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SLE Micro 5.1 | kernel-rt +1 | 5.3.18-150300.223.1 | SUSE-SU-2025:03613-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_31 | 1-150500.11.3.1 | SUSE-SU-2025:03615-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_45 | 1-150400.9.3.1 | SUSE-SU-2025:03628-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_62 | 1-150300.7.3.1 | SUSE-SU-2025:03626-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.275.1 | SUSE-SU-2025:03614-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_73 | 1-8.3.1 | SUSE-SU-2025:03614-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.124.1 | SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.124.1.150500.6.59.1 | SUSE-SU-2025:03615-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SLE HPC 15 SP3 | kernel-64kb +6 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
| SUSE Manager Server LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Server LTS 4.3 | kernel-syms +3 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-default-base | 5.14.21-150400.24.179.1.150400.24.92.1 | SUSE-SU-2025:03628-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-syms +2 | 5.14.21-150400.24.179.1 | SUSE-SU-2025:03628-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +6 | 5.3.18-150300.59.221.1 | SUSE-SU-2025:03626-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.221.1.150300.18.132.1 | SUSE-SU-2025:03626-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.355-280.698 | 1.0-0.amzn2 | ALAS2-2025-3038 |
| Amazon Linux 2 | perf +8 | 4.14.355-280.698.amzn2 | ALAS2-2025-3038 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +12 | 3.10.0-1160.119.1.0.16.el7 | ELSA-2025-23947 |
Advisories 19
- RHSA-2025:22752 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2025-2092 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 9, 2026
- RHSA-2023:2951 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:2458 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:23445 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2026-0349 Dell Avamar und NetWorker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- RHSA-2025:23960 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:23947 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2025:22006 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2023:0832 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Aug 6, 2026
- SUSE-SU-2025:03613-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03615-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03626-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3761-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03628-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03614-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3716-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-23947 Moderate: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 30, 2026
- ALAS2-2025-3038 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 14, 2025
References
- https://git.kernel.org/stable/c/2007867c5874134f2271eb276398208070049dd3
- https://git.kernel.org/stable/c/2be9331ca6061bc6ea32247266f45b8b21030244
- https://git.kernel.org/stable/c/ea4c3eee0fd72fcedaa238556044825639cd3607
- https://git.kernel.org/stable/c/1868332032eccbab8c1878a0d918193058c0a905
- https://git.kernel.org/stable/c/401bc1f90874280a80b93f23be33a0e7e2d1f912