DEBIAN-CVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix XDR length calculation in nfsd4ffencodelayoutget  The XDR buffer size calculation in nfsd4ffencodelayoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client:   - fhlen doesn't account for XDR padding on the file handle data  - uid and gid lengths use "8 + len" but xdrencodeopaque() actually    writes "4 + xdralignsize(len)" bytes  - dslen omits the flags and statscollecthint fields (8 bytes),    while len's header constant overestimates by 8 bytes -- these    partially cancel but leave a net mismatch  The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client.  Fix this by breaking out every encoded field explicitly in the dslen calculation, using xdralign_size() for all variable-length opaque fields, and correcting the header constants.