Back to Security Advisories

Libnfs Vulnerability — Ubuntu Security Update (USN-9008-1)

USN-9008-1 fixes CVE-2026-108985 in libnfs on Ubuntu: the ZDR decoder did not enforce the maximum size bound, producing an out-of-bounds write — a remote attacker with crafted network traffic can crash libnfs (denial of service) or potentially execute arbitrary code. CVSS 7.1, CWE-787. Update: sudo apt update && sudo apt upgrade libnfs and restart services using it.

Critical 7.1 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

An out-of-bounds write in an NFS library parsing network traffic is remotely reachable memory corruption — on servers mounting NFS shares, crafted traffic against the mount becomes a code-execution attempt in the client process.

  1. Ubuntu Security Notices

  2. USN-9008-1

Publication date

9 November 2026

Overview

libnfs could be made to crash or run programs if it received
specially crafted network traffic.

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • libnfs – NFS client library

Details

It was discovered that libnfs did not properly enforce the maximum
size bound during ZDR decoding, resulting in an out-of-bounds write.
An attacker could possibly use this issue to cause libnfs to crash,
resulting in a denial of service, or execute arbitrary code.

It was discovered that libnfs did not properly enforce the maximum
size bound during ZDR decoding, resulting in an out-of-bounds write.
An attacker could possibly use this issue to cause libnfs to crash,
resulting in a denial of service, or execute arbitrary code.

Update instructions

In general, a standard system update will make all the necessary
changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 libnfs14 – 

5.0.2-1ubuntu3.1
26.04

LTS resolute

 libnfs14 – 

5.0.2-1ubuntu1.2
24.04

LTS noble

 libnfs14 – 

5.0.2-1ubuntu0.24.04.2
22.04

LTS jammy

 libnfs13 – 

4.0.0-1ubuntu0.2

References

Frequently Asked Questions

What is CVE-2026-108985?
It is an out-of-bounds write in libnfs's ZDR decoding: the maximum size bound was not enforced during decoding, letting crafted network traffic crash libnfs or potentially execute arbitrary code. CVSS 7.1, CWE-787; fixed in USN-9008-1 (November 9, 2026).
Who is affected?
Ubuntu systems with libnfs installed where NFS mounts or library-based NFS access reach untrusted networks — cloud storage gateways, backup systems and NFS clients.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade libnfs and remount NFS shares / restart services using the library so the patched code is loaded.
Why is ZDR decoding a network-facing attack surface?
ZDR (XDR-style) decoding parses variable-length data structures received over the wire — size-bound enforcement is exactly the check that stops a crafted length field from writing past the buffer.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System