Advisories » MGASA-2026-0438

Updated libnfs package fixes a security vulnerability

Publication date: 23 Sep 2026
Modification date: 23 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-57918

Description

libnfs through 6.0.2 before 935b8db has an xid integer underflow in
READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection
to a crafted NFS server, when the expected pdu size exceeds the absolute
pdu size from the xid/record-marker. (CVE-2026-57918)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36185
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOJLZCLBA4FYYVRVR6YGNNEBZAVEEQ3G/
• https://www.cve.org/CVERecord?id=CVE-2026-57918

SRPMS

10/core

• libnfs-6.0.2-2.2.mga10