CVE-2026-57918: libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.
Overview
- Severity
- High (CVSS 7.1)
- CVSS Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Jun
- Released
- 2026-07-01
- EPSS Score
- 0.19% (percentile: 9.4%)
Affected Products (1)
Other
Revision History
- 2026-07-01: Information published.