Ubuntu Fixes libnfs Network Decoding Memory Corruption
Tech GuruQuick Answer
Update libnfs on the listed Ubuntu releases, restart applications using the library, test NFS access and retain full package and service-validation evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Ubuntu release, libnfs package and application consumers, NFS endpoints and network trust boundaries. Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 installations using the listed libnfs packages. Install the exact package for the Ubuntu release through the supported repositories; restart processes that load the updated library. Confirm the installed package and loaded library, test normal NFS operations and review application errors after restart.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | libnfs on supported Ubuntu releases |
|---|---|
| Advisory | USN-9008-1 |
| CVE | CVE-2026-108985 |
| Authoritative release date | November 9, 2026; official Ubuntu RSS publication timestamp 2026-11-09T13:29:36+00:00. |
| Authority revision date | No later revision is stated. |
| Affected versions | Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 installations using the listed libnfs packages. |
| Fixed version | 22.04: libnfs13 4.0.0-1ubuntu0.2; 24.04: libnfs14 5.0.2-1ubuntu0.24.04.2; 26.04: libnfs14 5.0.2-1ubuntu1.2; 26.10: libnfs14 5.0.2-1ubuntu3.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state exploitation in this notice.; no exploitation claim is inferred. |
What Changed
Ubuntu corrected an out-of-bounds write in libnfs ZDR decoding. Crafted network input could crash a consumer or execute code. The advisory identifies CVE-2026-108985.
What To Validate Now
- Inventory. Record Ubuntu release, libnfs package and application consumers, NFS endpoints and network trust boundaries.
- Establish applicability. Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 installations using the listed libnfs packages.
- Remediate. Install the exact package for the Ubuntu release through the supported repositories; restart processes that load the updated library.
- Validate. Confirm the installed package and loaded library, test normal NFS operations and review application errors after restart.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve the package-to-release mapping. Updating a library on disk does not replace a running process; coordinate restart and storage-dependent workflows.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
