CVE-2026-108985: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-108985 is an out-of-bounds write vulnerability in the ZDR (eXternal Data Representation) decoding routines of libnfs, an NFS client library maintained by Ronnie Sahlberg. The flaw exists in lib/libnfs-zdr.c within the functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(), where the caller-supplied maxsize parameter is never enforced, allowing writes beyond allocated buffer boundaries. It affects libnfs through version 6.0.2 (all commits prior to 7613236464317bee2d9636f087f995148de4db27). Disclosed on October 12, 2026, it carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write). In the affected ZDR decode functions, the wire-supplied length field is read from the network buffer and used directly in memcpy() operations into caller-supplied or dynamically allocated buffers without first verifying that the length does not exceed the maxsize bound passed by the caller. Protocol-defined limits such as NFS4_FHSIZE and NFS4_OPAQUE_LIMIT, which are passed as maxsize by the generated decoders, were silently ignored. The fix introduces a libnfs_zdr_size_ok() helper that enforces a hard upper bound for any positive maxsize value before any copy or allocation occurs, while treating 0 and ~0 as unlimited to preserve compatibility with existing rpcgen-generated code (GitHub Commit, GitHub Advisory). The vulnerability was reported by Jinpyo Lee of the Tobabz Team.

Successful exploitation can result in heap or stack memory corruption due to out-of-bounds writes, potentially leading to arbitrary code execution or application crash (denial of service). The integrity impact is rated Low and availability impact is rated High, with no confidentiality impact assessed. Applications and services that use libnfs to process NFS protocol messages — including embedded systems, NAS devices, and media players — are at risk if they process attacker-controlled NFS responses (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). Exploitation requires user interaction — a user or application must connect to and process responses from a malicious or compromised NFS server. The EPSS score is 0.0, indicating very low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory). No threat actor attribution has been reported.

1. Set up a malicious NFS server: Deploy a rogue NFS server that responds to NFS protocol requests with crafted ZDR-encoded messages containing length fields that exceed the maxsize bounds expected by the client (e.g., a field declared as NFS4_FHSIZE bytes but with a wire length far exceeding that limit).
2. Lure the victim client: Induce a user or application running a vulnerable version of libnfs (≤ 6.0.2) to mount or connect to the malicious NFS server — this may involve DNS spoofing, ARP poisoning, or social engineering.
3. Trigger the vulnerable decode path: When the libnfs client processes the server's response, the ZDR decoder calls libnfs_zdr_bytes(), libnfs_zdr_string(), or libnfs_zdr_array() with the oversized length, which is passed directly to memcpy() without checking against maxsize.
4. Achieve out-of-bounds write: The oversized memcpy() writes attacker-controlled data beyond the allocated buffer boundary, corrupting adjacent heap or stack memory.
5. Achieve code execution or crash: Depending on memory layout and exploit precision, the attacker may redirect control flow to execute arbitrary code, or cause the application to crash (GitHub Commit, GitHub Advisory).

• Network: Unexpected or unsolicited NFS server responses containing abnormally large field lengths in ZDR-encoded messages; NFS traffic originating from untrusted or unknown IP addresses.
• Process: Application crashes or segmentation faults in processes using libnfs (e.g., nfs-client, media players, or NAS management daemons) when connecting to NFS shares.
• Logs: Crash dumps or core files associated with libnfs-linked binaries; error logs referencing libnfs-zdr.c or ZDR decode failures; unexpected process termination events in system logs (/var/log/syslog, dmesg).
• File System: Presence of core dump files (e.g., core.*) in application working directories following NFS operations against untrusted servers.

Upgrade libnfs to a version that includes commit 7613236464317bee2d9636f087f995148de4db27 or later (any version after 6.0.2 containing this fix). As a network-level workaround, restrict NFS traffic using firewall rules to allow connections only to trusted, known-good NFS servers. If NFS functionality is not required, disable or remove libnfs-dependent services. Input validation at the network boundary to reject oversized NFS protocol messages can also reduce exposure (GitHub Commit, GitHub Advisory).

The vulnerability was reported to the libnfs maintainer by Jinpyo Lee of the Tobabz Team, who identified that the maxsize bound was never enforced in the ZDR decoder. The fix was committed by Ronnie Sahlberg with detailed commentary explaining the design intent for 0 and ~0 as unlimited values. Social media activity was limited to automated CVE tracking posts on Bluesky and Mastodon/infosec.exchange shortly after disclosure (GitHub Commit).