The Linux kernel's nfsd4_ff_encode_getdeviceinfo() function incorrectly calculates the reservation size for da_addr_body as 16 + netid_len + addr_len, while the actual encoding via xdr_encode_opaque() writes 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. This mismatch causes the declared length to be larger than the actual data by 2-8 bytes, resulting in leakage of stale reply-page content to clients and misalignment in decoding the version list. The fix involves using xdr_align_size() to correctly align string lengths to match the actual encoded size.

Clients receiving GETDEVICEINFO replies from the vulnerable nfsd may receive stale data from previous replies due to the length mismatch, potentially leaking unintended information. Additionally, the misalignment can cause errors in decoding subsequent version list data. There is no indication of remote code execution or privilege escalation from this vulnerability.

A fix has been implemented in the Linux kernel to correct the XDR padding calculation by using xdr_align_size() for string lengths. Users should apply the official kernel update that includes this fix. Since no vendor advisory or patch link is provided, check the Linux kernel mailing lists or official repositories for the patch and update guidance.