CVE-2026-89698

nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

Published Sep 11, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
"struct sockaddr" (16 bytes). When an IPv6 NFS client is connected,
nfsd_genl_rpc_status_compose_msg() casts these fields to
"struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24,
which extends 8 bytes past the end of the 16-byte sockaddr field into
the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8
bytes of truncated IPv6 address followed by 8 bytes of rq_flags to
userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes.

This is reachable by any unprivileged process in the network namespace
because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without
GENL_ADMIN_PERM.

Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the
IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage)
bytes in the memcpy calls so the full address is captured, and
zero-initializing the genl_rqstp stack variable to prevent leaking
uninitialized tail bytes through netlink.

Analysis

Technical impact

A buffer over‑read in the Linux kernel's NFS read past the bounds of a struct sockaddr field and leak unmember. The over‑read can expose memory contents to userspace via NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes, potentially revealing sensitive data. The flaw arises when an IPv6 client is serviced, causing the code to cast to a larger struct sockaddr_in6 and read beyond its allocated space. This weakness falls under CWE‑125 – Buffer Over‑read.

Affected Systems

The vulnerability is present in the Linux kernel on all versions before the removal of the prototype that declares rq_daddr and rq_saddr as plain struct sockaddr. Exact version ranges are not provided, but all builds that have not applied the patch commit that widens these fields to struct sockaddr_storage are affected.

Risk and Exploitability

The CVSS base score is 6.5, indicating a medium severity that can be leveraged by any unprivileged process running in the same network namespace. The EPSS score is < 1%, and the entry is not listed in the CISA KEV catalog, suggesting no widespread exploitation detected yet. Because the attack path requires no special privileges and relies on standard NFS netlink commands, the risk to untrusted users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 9a2e791639a1c5cac3f219b0d2632835d8f88d27
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< dcb69ad0dafb4a24b825183bb94055d5be8a10bd
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< a99d720ed2a5258564e5e9d5f39f3184a030d354

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,dcb69ad0dafb4a24b825183bb94055d5be8a10bd)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,a99d720ed2a5258564e5e9d5f39f3184a030d354)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that widens nfsd_genl_rqstp address fields to sockaddr_storage (commit c03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5).
If possible, configure the kernel to to unprivileged users or disable NFSD_CMD_RPC_STATUS_GET in the NFS configuration.
Verify that the kernel does not expose the genl_rqstp stack variable and monitor netlink traffic for unexpected RPC_STATUS_GET requests.

Generated by OpenCVE AI on September 15, 2026 at 19:57 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5
https://git.kernel.org/stable/c/9a2e791639a1c5cac3f219b0d2632835d8f88d27
https://git.kernel.org/stable/c/a99d720ed2a5258564e5e9d5f39f3184a030d354
https://git.kernel.org/stable/c/dcb69ad0dafb4a24b825183bb94055d5be8a10bd
https://nvd.nist.gov/vuln/detail/CVE-2026-89698
https://www.cve.org/CVERecord?id=CVE-2026-89698

History

Sep 21, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9a2e791639a1c5cac3f219b0d2632835d8f88d27

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89698 https://www.cve.org/CVERecord?id=CVE-2026-89698
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.
Title		nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5 https://git.kernel.org/stable/c/a99d720ed2a5258564e5e9d5f39f3184a030d354 https://git.kernel.org/stable/c/dcb69ad0dafb4a24b825183bb94055d5be8a10bd