CVE-2026-89702 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: size fh_verify server sockaddr slot by xpt_locallen
The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the server sockaddr slot sized by xpt_remotelen but fill it from xpt_local using xpt_locallen:
TP_STRUCT__entry( ... __sockaddr(server, rqstp->rq_xprt->xpt_remotelen) ... ) TP_fast_assign( ... __assign_sockaddr(server, &rqstp->rq_xprt->xpt_local, rqstp->rq_xprt->xpt_locallen); ... )
When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past the reserved ring-buffer slot. In the reverse direction (xpt_locallen < xpt_remotelen) the slot is oversized and the unwritten tail leaks prior ring-buffer contents to trace consumers.
The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote() is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from the RDMA connect path; svc_create_socket() for UDP calls only svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request then copies 16 or 28 bytes from xpt_local into a zero-byte slot.
The other NFSD tracepoints that record the server address (NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, SVC_RQST_ENDPOINT_FIELDS) already size the server slot by xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only exceptions.
Fix by sizing the server slot with xpt_locallen so the declared slot matches the copy length. The client slot and its assignment already agree on xpt_remotelen and are left untouched.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel NFS daemon subsystem represents a critical memory safety flaw rooted in inconsistent buffer sizing within tracepoint definitions. Specifically, the nfsd_fh_verify and nfsd_fh_verify_err tracepoints incorrectly declare the server sockaddr slot size based on xpt_remotelen while simultaneously filling this slot using data from xpt_local with a length determined by xpt_locallen. This discrepancy creates two distinct memory corruption scenarios depending on the relationship between these two length variables. When xpt_locallen exceeds xpt_remotelen, the __assign_sockaddr function performs a memcpy operation that writes past the end of the reserved ring-buffer slot. Conversely, when xpt_locallen is less than xpt_remotelen, the allocated buffer is larger than necessary, resulting in an information leak where unwritten portions of the memory retain previous contents from the ring buffer and are exposed to trace consumers. This inconsistency highlights a failure in aligning declared data structures with actual copy operations during kernel tracing activities.
The operational impact of this vulnerability is particularly severe due to its reachability on NFS/UDP protocols, which were historically common before the widespread adoption of TCP-based NFS versions. The root cause lies in how network transport addresses are initialized for different protocol types. For UDP connections, the function svc_xprt_set_remote() is never invoked; instead, only svc_xprt_set_local() is called during socket creation via svc_create_socket(). Consequently, xpt_remotelen remains zero throughout the lifetime of an NFS/UDP transport structure. Since nfsd_fh_verify and nfsd_fh_verify_err are triggered for every file handle verification request in NFSv2 and NFSv3 over UDP, these tracepoints consistently attempt to copy 16 bytes (for IPv4) or 28 bytes (for IPv6) from xpt_local into a slot sized at zero. This results in an out-of-bounds write that corrupts adjacent memory regions within the kernel's tracing infrastructure, potentially leading to system instability, denial of service, or arbitrary code execution if the corrupted data influences subsequent control flow decisions.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, as it involves writing beyond allocated memory boundaries due to incorrect size assumptions. Additionally, the information leak aspect in cases where xpt_locallen is smaller than xpt_remotelen corresponds to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In terms of attack surface and behavior mapping under MITRE ATT&CK for Enterprise or ICS, this flaw relates to T1564 Hidden Processes and Artifacts if the corruption allows evasion of detection mechanisms, though primarily it falls under exploitation techniques involving memory corruption such as T1203 Exploitation for Defense Evasion. The vulnerability is specific to kernel-space tracing code rather than user-facing APIs, making direct remote exploitation more complex but not impossible given the privileged nature of tracepoint data access and potential side-channel implications through ring buffer analysis by local users with appropriate permissions.
The resolution involves correcting the declaration in nfsd_fh_verify and nfsd_fh_verify_err to size the server sockaddr slot using xpt_locallen instead of xpt_remotelen, thereby ensuring that the allocated memory matches the actual amount of data being copied. This fix aligns these specific tracepoints with other NFSD tracepoints such as NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, and SVC_RQST_ENDPOINT_FIELDS, which already correctly use xpt_locallen for server address sizing. The client slot remains unaffected because its declaration and assignment consistently rely on xpt_remotelen, maintaining internal consistency within the transport structure handling logic. Administrators should apply kernel updates that include this patch to prevent potential memory corruption issues during NFS operations over UDP. Regular auditing of tracepoint configurations and ensuring alignment between buffer declarations and copy lengths is recommended as a best practice for maintaining kernel integrity in network service daemons.