CVE-2008-3915

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-11 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.

Affected products

Linux kernel: 2.6.18, 2.6.19.4, 2.6.19.5, 2.6.19.7, 2.6.20.16, 2.6.20.17 (+57)

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=91b80969ba466ba4b915a4a1d03add8c297add3f
http://lkml.org/lkml/2008/9/3/286
http://secunia.com/advisories/31881
http://secunia.com/advisories/32190
http://secunia.com/advisories/32393
http://www.debian.org/security/2008/dsa-1636
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4
http://www.openwall.com/lists/oss-security/2008/09/04/18
http://www.openwall.com/lists/oss-security/2008/09/04/4
http://www.redhat.com/support/errata/RHSA-2008-0857.html
http://www.securityfocus.com/bid/31133
http://www.ubuntu.com/usn/usn-659-1

Get alerted when CVE-2008-3915 or the next vulnerability affects your stack