The Linux kernel contained a vulnerability in the nfsd4_ff_encode_layoutget() function related to incorrect XDR buffer size calculations. Specifically, the file handle length did not account for XDR padding, the uid and gid lengths were miscalculated due to incorrect assumptions about the bytes written by xdr_encode_opaque(), and the ds_len calculation omitted certain fields while overestimating others, resulting in a net mismatch. This could cause the function to write up to 5 bytes beyond the reserved buffer or send stale kernel memory to clients. The fix involved explicitly calculating each encoded field's length, applying xdr_align_size() to all variable-length opaque fields, and correcting header constants to ensure accurate buffer size reservation.

The vulnerability could lead to out-of-bounds memory writes or disclosure of uninitialized kernel memory to NFS clients. This may result in information leakage or potential kernel memory corruption. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the XDR buffer size calculations in nfsd4_ff_encode_layoutget(). Users should apply the official kernel updates containing this fix when available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.