CVE-2026-105516: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-105516 is a stack-based buffer overflow vulnerability in the 9P protocol implementation of NFS-Ganesha, a user-space NFS server. The flaw exists in the TWALK request handler, which fails to validate the number of path components against the protocol-defined limit of 16, allowing an unauthenticated remote attacker to crash the server or potentially execute arbitrary code. It was reported on October 5, 2026, and affects at least NFS-Ganesha versions up to and including V15.6 (with V15.2 confirmed identical in affected code). The CVE status is currently Reserved. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a CWE-121 (Stack-based Buffer Overflow) in src/Protocols/9P/9p_walk.c. The function _9p_walk() reads the client-controlled nwname field (a 16-bit unsigned integer, range 0–65535) at line 71 without checking it against the protocol maximum _9P_MAXWELEM (defined as 16 in src/include/9p.h:246). The reply loop at line 230 serializes 13 bytes per path component into a fixed 70,000-byte stack buffer (replydata[_9P_MSG_SIZE], allocated in 9p_interpreter.c:127). At approximately 5,400 components, the write overflows by ~209 bytes, overwriting the stack canary and saved return address. Critically, the bounds check (_9p_checkbound, line 237) executes after the writes, making it ineffective. The 9P authentication handler (src/Protocols/9P/9p_auth.c:74) unconditionally returns EOPNOTSUPP, meaning TATTACH succeeds without any prior authentication exchange regardless of SecType export configuration, making the vulnerability reachable pre-authentication (Red Hat Bugzilla).

An unauthenticated attacker with network access to the NFS-Ganesha 9P listener can send a crafted TWALK message to crash the server (denial of service) or potentially achieve remote code execution on the host system. Because no credentials are required, the attack surface encompasses any network-reachable NFS-Ganesha instance with the 9P protocol enabled. Successful code execution would grant the attacker control of the NFS-Ganesha service process, potentially exposing all file system data served by the instance and enabling lateral movement within the network (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability was confirmed via source code analysis of NFS-Ganesha V15.6, and reproduction in an ASAN-instrumented build triggered a SEGV (memory corruption), though full end-to-end stack overflow reproduction requires real root privileges for the VFS FSAL's name_to_handle_at syscall. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS 9.8 score reflects the network-accessible, pre-authentication, no-user-interaction attack vector (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible NFS-Ganesha servers with the 9P protocol listener enabled (default TCP port 564) using network scanners such as Nmap or Shodan.
2. Establish 9P connection: Connect to the 9P listener using any 9P client or raw TCP socket — no credentials are required as TAUTH is not implemented and returns EOPNOTSUPP.
3. Perform TATTACH: Send a valid TATTACH message to attach to an exported file system. This succeeds subject only to export/client policy, with no authentication exchange.
4. Craft malicious TWALK message: Construct a TWALK request with the nwname field set to a large value (e.g., 5,400 or more path components). Each component name can be minimal (e.g., a single byte).
5. Trigger stack buffer overflow: Send the crafted TWALK message. The server's _9p_walk() function will serialize 13 bytes per component into the fixed 70,000-byte stack buffer without bounds checking, overflowing the buffer at ~5,400 components by ~209 bytes, overwriting the stack canary and saved return address.
6. Achieve crash or code execution: At minimum, the server crashes (denial of service). With a carefully crafted payload and control of the overflow data, an attacker may redirect execution to attacker-controlled code for remote code execution (Red Hat Bugzilla).

• Network: Unexpected or high-volume TCP connections to port 564 (9P protocol listener) from untrusted or external IP addresses; TWALK messages with anomalously large nwname values (>16 path components, especially thousands).
• Logs: NFS-Ganesha service logs showing sudden crashes, segmentation faults, or abnormal termination following 9P TWALK requests; repeated TATTACH attempts from a single source without subsequent legitimate file operations.
• Process: NFS-Ganesha process (ganesha.nfsd) crashing or restarting unexpectedly; ASAN/stack canary violation messages in instrumented builds (e.g., stack-buffer-overflow or SEGV in ASAN output).
• File System: Unexpected files or scripts appearing in directories served by NFS-Ganesha following a crash-and-restart cycle, which could indicate post-exploitation activity if RCE was achieved.

The upstream NFS-Ganesha project has confirmed the vulnerability and plans to remediate it by removing the 9P protocol implementation entirely from the next release. A patch is noted as available via the Red Hat Bugzilla tracker. Until a patched version is deployed, administrators should restrict network access to the 9P listener (TCP port 564) using firewall rules to allow only explicitly trusted clients. Disabling the 9P protocol in NFS-Ganesha's configuration is also recommended if 9P functionality is not required. Monitor for unusual TWALK messages with excessive path component counts as a detection measure (Red Hat Bugzilla, Red Hat CVE).