CVE-2026-89698
UnknownSummary
In the Linux kernel, struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as plain struct sockaddr (16 bytes). With an IPv6 NFS client connected, nfsd_genl_rpc_status_compose_msg() cast these fields to struct sockaddr_in6 (28 bytes), reading 8 bytes past the field and shipping a truncated IPv6 address plus part of rq_flags to userspace via netlink.
Risk Assessment
A potential disclosure of 8 bytes from the adjacent rq_flags field to an unprivileged process in the network namespace. The vulnerability is reachable without privileges because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM.
Recommendation
Update the Linux kernel to a version with the fix widening rq_daddr and rq_saddr to struct sockaddr_storage and zero-initializing the genl_rqstp variable to prevent leaking uninitialized bytes.
Other vulnerabilities in Linux kernel (nfsd)
See all- CVE-2026-89706Unknown
In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.
- CVE-2026-89705Unknown
In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.
- CVE-2026-89704Unknown
In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.
- CVE-2026-89703Unknown
In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().
- CVE-2026-89701Unknown
In the Linux kernel, the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. A malicious client could send a malformed timespec that propagated through notify_change() to disk.
- CVE-2026-89700Unknown
In the Linux kernel, the nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller could send a 16-byte address with sa_family=AF_INET6, causing a 12-byte out-of-bounds read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).
- CVE-2026-89699Unknown
In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.
- CVE-2026-89697Unknown
In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.
- CVE-2026-89696Unknown
In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.
- CVE-2026-89695Unknown
In the Linux kernel's nfsd module, nfsd4_decode_posixacl() accepts an unbounded ACL entry count from the client and passes it to an O(n^2) bubble sort. A client can choose an arbitrarily large value, causing excessive CPU consumption on the server. The symmetric NFS_ACL_MAX_ENTRIES check present on the encoder side is missing in the decoder.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.