CVE-2026-57918

Public on 2026-06-26
Modified on 2026-06-26
Description
libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core libnfs Not Affected
Amazon Linux 2023 libnfs Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-57918 Mitre: CVE-2026-57918