In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value.
Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3().
Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-livepatch-5.10.220-209.867Upgrade perfUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-tools-debuginfo | Aug 28, 2024 | Jul 16, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jul 30, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 11, 2025 | Jul 16, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 16, 2024 |
| Ubuntu | — | Upgrade linux-azure-fde-5.15Upgrade linux-intel-iotg-5.15 | Nov 19, 2024 | Jul 16, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub