CVE-2026-31402
published 2026-04-03CVE-2026-31402: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adjacent heap memory.
This can be triggered remotely by an unauthenticated attacker with two
cooperating NFSv4.0 clients: one sets a lock with a large owner string,
then the other requests a conflicting lock to provoke the denial.
We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full
opaque, but that would increase the size of every stateowner, when most
lockowners are not that large.
Instead, fix this by checking the encoded response length against
NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the
response is too large, set rp_buflen to 0 to skip caching the replay
payload. The status is still cached, and the client already received the
correct response on the original request.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f9fcb4441f6c02bb20c2eb340101e27dfe23607c | f9fcb4441f6c02bb20c2eb340101e27dfe23607c |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2665887a69437a8a4f552f69509eecfb73d4aa19 | 2665887a69437a8a4f552f69509eecfb73d4aa19 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c9452c0797c95cf2378170df96cf4f4b3bca7eff | c9452c0797c95cf2378170df96cf4f4b3bca7eff |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8afb437ea1f70cacb4bbdf11771fb5c4d720b965 | 8afb437ea1f70cacb4bbdf11771fb5c4d720b965 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0 | dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0f0e2a54a31a7f9ad2915db99156114872317388 | 0f0e2a54a31a7f9ad2915db99156114872317388 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ae8498337dfdfda71bdd0b807c9a23a126011d76 | ae8498337dfdfda71bdd0b807c9a23a126011d76 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5133b61aaf437e5f25b1b396b14242a6bb0508e2 | 5133b61aaf437e5f25b1b396b14242a6bb0508e2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 2.6.12.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect NFSv4.0 LOCK requests with large owner strings (approaching NFS4_OPAQUE_LIMIT of 1024 bytes) directed at an nfsd server, which is the trigger condition for the heap overflow in the replay cache. ↗
- →Monitor for slab-out-of-bounds kernel crash signatures or kernel memory corruption events on systems running nfsd (NFSv4.0 server), which may indicate exploitation of this vulnerability. ↗
- →The attack requires two cooperating NFSv4.0 clients — one to establish a lock with a large owner string and a second to request a conflicting lock. Correlate NFS LOCK denials with prior large-owner LOCK grants from different source IPs to the same server path. ↗
- →The vulnerable kernel code path is nfsd4_encode_operation() calling read_bytes_from_xdr_buf() with no bounds check into rp_ibuf[NFSD4_REPLAY_ISIZE]. Audit kernel builds for the presence of this unpatched code path (fixed in Linux kernel 6.19.10-1). ↗
- ·The vulnerability is only exploitable on systems running the Linux kernel nfsd with NFSv4.0 enabled. NFSv4.1+ and NFSv3 are not affected by this specific replay cache overflow. ↗
- ·The fix is available in Linux kernel 6.19.10-1 (Debian forky/sid). Red Hat Enterprise Linux 6, 7, 8, 9, and 10 remain affected or under investigation as of the advisory date — patch status should be verified per distribution. ↗
- ·The attacker does not need to be authenticated; the attack is remotely triggerable by any NFSv4.0 client that can reach the server, requiring no credentials. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
vendor_redhat·2026-04-03·CVSS 7.0
CVE-2026-31402 [HIGH] CWE-131 kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of
Debian
CVE-2026-31402: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix h...
vendor_debian·2026
CVE-2026-31402 CVE-2026-31402: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix h...
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjace
GHSA
GHSA-7xf5-3qmr-j4c6: In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4
ghsa_unreviewed·2026-04-03
CVE-2026-31402 GHSA-7xf5-3qmr-j4c6: In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adj
OSV
CVE-2026-31402: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4
osv·2026-04-03
CVE-2026-31402 CVE-2026-31402: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjace
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-31402 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-31402 CVE-2026-31402 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31402 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-b
Bugzilla
CVE-2026-31402 kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
bugzilla·2026-04-03
CVE-2026-31402 [HIGH] CVE-2026-31402 kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
CVE-2026-31402 kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-
https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7effhttps://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607chttps://access.redhat.com/errata/RHSA-2026:10108https://access.redhat.com/errata/RHSA-2026:11313https://access.redhat.com/errata/RHSA-2026:13565https://access.redhat.com/errata/RHSA-2026:13566https://access.redhat.com/errata/RHSA-2026:13577https://access.redhat.com/errata/RHSA-2026:13578https://access.redhat.com/errata/RHSA-2026:13664https://access.redhat.com/errata/RHSA-2026:13681https://access.redhat.com/errata/RHSA-2026:13734https://access.redhat.com/errata/RHSA-2026:13936https://access.redhat.com/errata/RHSA-2026:14137https://access.redhat.com/errata/RHSA-2026:14165https://access.redhat.com/errata/RHSA-2026:14301https://access.redhat.com/errata/RHSA-2026:14823https://access.redhat.com/errata/RHSA-2026:14869https://access.redhat.com/errata/RHSA-2026:14925https://access.redhat.com/errata/RHSA-2026:15883https://access.redhat.com/errata/RHSA-2026:19568https://access.redhat.com/errata/RHSA-2026:19569https://access.redhat.com/security/cve/CVE-2026-31402https://bugzilla.redhat.com/show_bug.cgi?id=2454844https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json
2026-04-03
Published