CVE-2021-47168

What it actually does

Incorrect buffer size calculation in filelayout_decode_layout() uses sizeof(struct nfs_fh) instead of NFS_MAXFHSIZE when copying into the .data[] field, causing a two-byte overrun and memory corruption in the Linux kernel NFS client.

Why it matters to the business

NFS-based file sharing and storage workloads on affected kernels risk kernel crashes, data corruption, or potential privilege escalation, which can interrupt production storage services and require emergency reboots or rollbacks.

How an attack unfolds

An attacker controlling an NFS server or a man-in-the-middle position returns a crafted layout reply; the client decodes it using the oversized limit, corrupting adjacent kernel structures and enabling code execution or denial of service.

How to fix it

Upgrade to a kernel containing the upstream fix that replaces the incorrect sizeof with NFS_MAXFHSIZE; rebuild and reboot all systems that mount NFSv4.1+ file systems.

How to confirm the fix worked

Confirm the corrected source uses NFS_MAXFHSIZE on the left-hand side of the size check and that the running kernel reports a version after the patch commit; recompile with KASAN or similar to verify no overrun on crafted layouts.

Typical attack path

1. Position attacker-controlled NFS server or network path
2. Trigger client mount or layout recall that invokes filelayout_decode_layout()
3. Supply layout containing maximum-length file handle to trigger overrun
4. Leverage resulting memory corruption for arbitrary read/write or crash

How to detect it

Search kernel logs for oops or panic messages referencing filelayout_decode_layout or nfs_fh; inspect crash dumps for buffer overruns near NFS layout structures.

What your security team should do

• Prioritize kernel updates on all NFS clients within the next maintenance window
• Restrict NFS mounts to trusted servers until patches are applied
• Enable kernel memory protection features (KASLR, SMEP, SMAP) as compensating controls
• Add monitoring for unexpected NFS client oops or panics