CVE-2026-89702 - Vulnerability Details

- nfsd: size fh_verify server sockaddr slot by xpt_locallen

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: size fh_verify server sockaddr slot by xpt_locallen

The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the
server sockaddr slot sized by xpt_remotelen but fill it from
xpt_local using xpt_locallen:

TP_STRUCT__entry(
...
__sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
...
)
TP_fast_assign(
...
__assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,
rqstp->rq_xprt->xpt_locallen);
...
)

When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy
writes past the reserved ring-buffer slot. In the reverse direction
(xpt_locallen < xpt_remotelen) the slot is oversized and the
unwritten tail leaks prior ring-buffer contents to trace consumers.

The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()
is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from
the RDMA connect path; svc_create_socket() for UDP calls only
svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's
lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request
then copies 16 or 28 bytes from xpt_local into a zero-byte slot.

The other NFSD tracepoints that record the server address
(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,
SVC_RQST_ENDPOINT_FIELDS) already size the server slot by
xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only
exceptions.

Fix by sizing the server slot with xpt_locallen so the declared slot
matches the copy length. The client slot and its assignment already
agree on xpt_remotelen and are left untouched.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel NFSd tracepoint code wrongly sizes the buffer used for the server sockaddr remote length, leading to an out‑of‑bounds write. The overflow can corrupt kernel memory and expose previously recorded trace data, providing an information‑disclosure vector and, due to execution in kernel context, a potential path to arbitrary code execution. The weakness is classified as CWE‑787.

Affected Systems

The vulnerability affects Linux kernel builds that run an NFS server and accept NFSv2 or NFSv3 requests over UDP. Any kernel containing the unpatched nfsd_fh_verify_err tracepoint is vulnerable. Users should verify that their kernel includes the patch that sizes the server slot with the fix to be immune.

Risk and Exploitability

The CVSS score of 9.8 and the EPSS score of <1% and absence from the CISA KEV catalog indicate no known public exploits. The overrun is reachable by a remote could lead to privilege and high impact warrants urgent action.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`051382885552e12541cc0ebf82092be374a9ed2a`	affected	< 95d064f9828a20ccca5ae90a17be3e2076f25272
`051382885552e12541cc0ebf82092be374a9ed2a`	affected	< 7ff8d6363cffff45654ea85e319f7c0c54226012
`051382885552e12541cc0ebf82092be374a9ed2a`	affected	< 719a10e3f5f868c3c4ac3cf3648c5775d12034bd
`051382885552e12541cc0ebf82092be374a9ed2a`	affected	< 71d068490098b1d23c63b2345e40675d3a1ca763
`dcbebc86850324fbe0a993ce352f0539cd98038a`	affected	—
`62980365d6e894234b29f44fb2bfad4f7f8bb824`	affected	—
`5.15.154`	affected	< 5.16

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[051382885552e12541cc0ebf82092be374a9ed2a,95d064f9828a20ccca5ae90a17be3e2076f25272)`	affected	code_commit	—
`[051382885552e12541cc0ebf82092be374a9ed2a,71d068490098b1d23c63b2345e40675d3a1ca763)`	affected	code_commit	—
`[051382885552e12541cc0ebf82092be374a9ed2a,719a10e3f5f868c3c4ac3cf3648c5775d12034bd)`	affected	code_commit	—
`[051382885552e12541cc0ebf82092be374a9ed2a,7ff8d6363cffff45654ea85e319f7c0c54226012)`	affected	code_commit	—
`dcbebc86850324fbe0a993ce352f0539cd98038a`	affected	code_commit	—
`62980365d6e894234b29f44fb2bfad4f7f8bb824`	affected	code_commit	—
`[5.15.154,5.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[0,6.13.0)`	unaffected	generic	—
`[0,6.19.0)`	unaffected	generic	—
`[0,7.3.0)`	unaffected	generic	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the fix.
If NFS over UDP must remain enabled, restrict NFS traffic to trusted networks or switch to NFS over TCP to bypass the vulnerable code path.
Configure automated monitoring of NFS traffic and audit logs to detect anomalous tracepoint activity.

Generated by OpenCVE AI on September 15, 2026 at 20:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00671.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd
https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763
https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012
https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272
https://nvd.nist.gov/vuln/detail/CVE-2026-89702
https://www.cve.org/CVERecord?id=CVE-2026-89702

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-200

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89702 https://www.cve.org/CVERecord?id=CVE-2026-89702
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-200

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the server sockaddr slot sized by xpt_remotelen but fill it from xpt_local using xpt_locallen: TP_STRUCT__entry( ... __sockaddr(server, rqstp->rq_xprt->xpt_remotelen) ... ) TP_fast_assign( ... __assign_sockaddr(server, &rqstp->rq_xprt->xpt_local, rqstp->rq_xprt->xpt_locallen); ... ) When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past the reserved ring-buffer slot. In the reverse direction (xpt_locallen < xpt_remotelen) the slot is oversized and the unwritten tail leaks prior ring-buffer contents to trace consumers. The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote() is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from the RDMA connect path; svc_create_socket() for UDP calls only svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request then copies 16 or 28 bytes from xpt_local into a zero-byte slot. The other NFSD tracepoints that record the server address (NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, SVC_RQST_ENDPOINT_FIELDS) already size the server slot by xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only exceptions. Fix by sizing the server slot with xpt_locallen so the declared slot matches the copy length. The client slot and its assignment already agree on xpt_remotelen and are left untouched.
Title		nfsd: size fh_verify server sockaddr slot by xpt_locallen
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763 https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012 https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:19.537Z

Updated: 2026-09-13T06:33:23.537Z

Reserved: 2026-09-11T19:38:34.750Z

Link: CVE-2026-89702

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:57.413

Modified: 2026-09-13T07:17:35.723

Link: CVE-2026-89702

Redhat

Severity : Important

Publid Date: 2026-09-11T19:46:19Z

Links: CVE-2026-89702 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:15:14Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object