Description
libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sahlberg | libnfs | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libnfs | 6.0.2-1.1 | openSUSE-SU-2026:11246-1 |
Advisories 1
- openSUSE-SU-2026:11246-1 libnfs-devel-6.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026