Bug 2549456 (CVE-2026-108985)

Summary: CVE-2026-108985 libnfs: libnfs: Denial of Service via out-of-bounds write in ZDR decoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libnfs. During data decoding, the library fails to honor the maximum buffer size specified by the caller when processing data structures such as strings, bytes, and arrays. A remote attacker could exploit this vulnerability by providing specially crafted network data, triggering an out-of-bounds memory write. This issue primarily leads to a Denial of Service (DoS) through application crashes, and may potentially cause memory corruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2550246, 2550247    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-12 03:21:22 UTC 
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.