Search: CVE-2026-31402

A heap overflow vulnerability exists in the Linux kernel's NFSv4.0 server (nfsd) due to an undersized replay cache buffer that does not account for large lock owner strings in LOCK denied responses. This flaw can be triggered remotely by an unauthenticated attacker using two cooperating NFSv4.0 clients, leading to a slab-out-of-bounds write that corrupts adjacent heap memory. The issue has been fixed by adding a length check before copying responses into the replay buffer, skipping caching if the response is too large while still caching the status. The vulnerability has a critical severity with a CVSS score of 9.8 and affects Linux kernel version 2.6.12. No known exploits in the wild have been reported.