Heap overflow in Linux kernel nfsd NFSv4.0 LOCK replay cache

CVE-2026-31402 is a heap-based buffer overflow in the Linux kernel NFS server (nfsd), specifically in the NFSv4.0 LOCK replay cache. The replay cache stores encoded operation responses in a fixed 112-byte inline buffer, rp_ibuf[NFSD4_REPLAY_ISIZE], whose size was derived from OPEN responses. However, denied LOCK responses can include a conflicting lock owner field with variable length up to NFS4_OPAQUE_LIMIT (1024 bytes). When a LOCK request is denied because of a conflicting existing lock with a large owner string, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() without adequate bounds checking. This can produce a slab out-of-bounds write of up to 944 bytes past the end of the heap buffer, corrupting adjacent kernel heap memory.