{ "affected": [ { "ranges": [ { "events": [ { "introduced": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2" }, { "fixed": "f9fcb4441f6c02bb20c2eb340101e27dfe23607c" }, { "fixed": "2665887a69437a8a4f552f69509eecfb73d4aa19" }, { "fixed": "c9452c0797c95cf2378170df96cf4f4b3bca7eff" }, { "fixed": "8afb437ea1f70cacb4bbdf11771fb5c4d720b965" }, { "fixed": "dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0" }, { "fixed": "0f0e2a54a31a7f9ad2915db99156114872317388" }, { "fixed": "ae8498337dfdfda71bdd0b807c9a23a126011d76" }, { "fixed": "5133b61aaf437e5f25b1b396b14242a6bb0508e2" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" } ] }, { "package": { "ecosystem": "Linux", "name": "Kernel" }, "ranges": [ { "events": [ { "introduced": "2.6.12" }, { "fixed": "5.10.253" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "5.11.0" }, { "fixed": "5.15.210" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "5.16.0" }, { "fixed": "6.1.167" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.2.0" }, { "fixed": "6.6.130" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.7.0" }, { "fixed": "6.12.78" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.13.0" }, { "fixed": "6.18.20" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.19.0" }, { "fixed": "6.19.10" } ], "type": "ECOSYSTEM" } ] } ], "database_specific": { "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31402.json" }, "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.", "id": "CVE-2026-31402", "modified": "2026-07-09T03:51:53.919698653Z", "published": "2026-04-03T15:16:05.724Z", "references": [ { "type": "WEB", "url": "https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:10108" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:11313" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13565" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13566" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13577" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13578" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13664" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13681" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13734" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:13936" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14137" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14165" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14301" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14823" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14869" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:14925" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:15883" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19568" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:19569" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36530" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36531" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36532" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36533" }, { "type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:36534" }, { "type": "ADVISORY", "url": "https://access.redhat.com/security/cve/CVE-2026-31402" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31402.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31402" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454844" }, { "type": "PACKAGE", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git" } ], "schema_version": "1.7.5", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "nfsd: fix heap overflow in NFSv4.0 LOCK replay cache" }