GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89702 (GCVE-0-2026-89702)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
nfsd: size fh_verify server sockaddr slot by xpt_locallen
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the server sockaddr slot sized by xpt_remotelen but fill it from xpt_local using xpt_locallen: TP_STRUCT__entry( ... __sockaddr(server, rqstp->rq_xprt->xpt_remotelen) ... ) TP_fast_assign( ... __assign_sockaddr(server, &rqstp->rq_xprt->xpt_local, rqstp->rq_xprt->xpt_locallen); ... ) When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past the reserved ring-buffer slot. In the reverse direction (xpt_locallen < xpt_remotelen) the slot is oversized and the unwritten tail leaks prior ring-buffer contents to trace consumers. The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote() is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from the RDMA connect path; svc_create_socket() for UDP calls only svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request then copies 16 or 28 bytes from xpt_local into a zero-byte slot. The other NFSD tracepoints that record the server address (NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, SVC_RQST_ENDPOINT_FIELDS) already size the server slot by xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only exceptions. Fix by sizing the server slot with xpt_locallen so the declared slot matches the copy length. The client slot and its assignment already agree on xpt_remotelen and are left untouched.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 051382885552e12541cc0ebf82092be374a9ed2a , < 95d064f9828a20ccca5ae90a17be3e2076f25272 (git)
Affected: 051382885552e12541cc0ebf82092be374a9ed2a , < 7ff8d6363cffff45654ea85e319f7c0c54226012 (git)
Affected: 051382885552e12541cc0ebf82092be374a9ed2a , < 719a10e3f5f868c3c4ac3cf3648c5775d12034bd (git)
Affected: 051382885552e12541cc0ebf82092be374a9ed2a , < 71d068490098b1d23c63b2345e40675d3a1ca763 (git)
Affected: dcbebc86850324fbe0a993ce352f0539cd98038a (git)
Affected: 62980365d6e894234b29f44fb2bfad4f7f8bb824 (git)
Affected: 5.15.154 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95d064f9828a20ccca5ae90a17be3e2076f25272",
              "status": "affected",
              "version": "051382885552e12541cc0ebf82092be374a9ed2a",
              "versionType": "git"
            },
            {
              "lessThan": "7ff8d6363cffff45654ea85e319f7c0c54226012",
              "status": "affected",
              "version": "051382885552e12541cc0ebf82092be374a9ed2a",
              "versionType": "git"
            },
            {
              "lessThan": "719a10e3f5f868c3c4ac3cf3648c5775d12034bd",
              "status": "affected",
              "version": "051382885552e12541cc0ebf82092be374a9ed2a",
              "versionType": "git"
            },
            {
              "lessThan": "71d068490098b1d23c63b2345e40675d3a1ca763",
              "status": "affected",
              "version": "051382885552e12541cc0ebf82092be374a9ed2a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dcbebc86850324fbe0a993ce352f0539cd98038a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "62980365d6e894234b29f44fb2bfad4f7f8bb824",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: size fh_verify server sockaddr slot by xpt_locallen\n\nThe nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the\nserver sockaddr slot sized by xpt_remotelen but fill it from\nxpt_local using xpt_locallen:\n\n    TP_STRUCT__entry(\n            ...\n            __sockaddr(server, rqstp-\u003erq_xprt-\u003expt_remotelen)\n            ...\n    )\n    TP_fast_assign(\n            ...\n            __assign_sockaddr(server, \u0026rqstp-\u003erq_xprt-\u003expt_local,\n                              rqstp-\u003erq_xprt-\u003expt_locallen);\n            ...\n    )\n\nWhen xpt_locallen exceeds xpt_remotelen, __assign_sockaddr\u0027s memcpy\nwrites past the reserved ring-buffer slot. In the reverse direction\n(xpt_locallen \u003c xpt_remotelen) the slot is oversized and the\nunwritten tail leaks prior ring-buffer contents to trace consumers.\n\nThe write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()\nis only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from\nthe RDMA connect path; svc_create_socket() for UDP calls only\nsvc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt\u0027s\nlifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request\nthen copies 16 or 28 bytes from xpt_local into a zero-byte slot.\n\nThe other NFSD tracepoints that record the server address\n(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,\nSVC_RQST_ENDPOINT_FIELDS) already size the server slot by\nxpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only\nexceptions.\n\nFix by sizing the server slot with xpt_locallen so the declared slot\nmatches the copy length. The client slot and its assignment already\nagree on xpt_remotelen and are left untouched."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The nfsd_fh_verify and nfsd_fh_verify_err tracepoints run in the in-kernel NFS server while handling NFSv2/v3 RPCs on UDP/2049; a remote packet reaches svc_udp_recvfrom, svc_process, nfsd_proc_getattr/nfsd3_proc_getattr, then fh_verify.\nAC:L - With the nfsd_fh_verify events enabled (a realistic nfsd tracing/perf deployment), every UDP fh_verify deterministically memcpy\u0027s 16 or 28 bytes of xpt_local into a 0-byte slot; no race, layout guess, or attacker-uncontrollable condition is required.\nPR:N - AUTH_NULL and AUTH_SYS verify no credentials, and GETATTR uses NFSD_MAY_NOP so a dummy filehandle still hits fh_verify (and nfsd_fh_verify_err on lookup failure); a UDP source-IP spoof or wildcard export satisfies the IP map without an authenticated principal.\nUI:N - The attacker sends crafted NFS/UDP RPCs unilaterally; no administrator or victim-client action is required at exploitation time, and tracing already being enabled is the scored configuration rather than user interaction.\nS:U - The overflow corrupts the host kernel\u0027s ftrace/perf ring buffer inside the NFS server\u0027s own kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - When the reserved sockaddr slot is larger than xpt_locallen, leftover prior ring-buffer contents including kernel pointers from other events leak to trace consumers; the UDP out-of-bounds write can also corrupt adjacent event headers so later parses treat neighbouring kernel memory as payload.\nI:H - On NFS/UDP, xpt_remotelen stays 0 so __assign_sockaddr copies 16 or 28 bytes of xpt_local past the reserved dynamic array into subsequent ring-buffer bytes and potentially the next sub-buffer page header, which is an out-of-bounds kernel write.\nA:H - Corrupting ring-buffer event headers or the next sub-buffer page metadata can oops or panic the tracer or hang consumers, and a remote peer can repeat the UDP request to force the overflow until the kernel faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:23.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012"
        },
        {
          "url": "https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763"
        }
      ],
      "title": "nfsd: size fh_verify server sockaddr slot by xpt_locallen",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89702",
    "datePublished": "2026-09-11T19:46:19.537Z",
    "dateReserved": "2026-09-11T19:38:34.750Z",
    "dateUpdated": "2026-09-13T06:33:23.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89702",
      "date": "2026-09-16",
      "epss": "0.00463",
      "percentile": "0.39128"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89702\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:57.413\",\"lastModified\":\"2026-09-13T07:17:35.723\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: size fh_verify server sockaddr slot by xpt_locallen\\n\\nThe nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the\\nserver sockaddr slot sized by xpt_remotelen but fill it from\\nxpt_local using xpt_locallen:\\n\\n    TP_STRUCT__entry(\\n            ...\\n            __sockaddr(server, rqstp-\u003erq_xprt-\u003expt_remotelen)\\n            ...\\n    )\\n    TP_fast_assign(\\n            ...\\n            __assign_sockaddr(server, \u0026rqstp-\u003erq_xprt-\u003expt_local,\\n                              rqstp-\u003erq_xprt-\u003expt_locallen);\\n            ...\\n    )\\n\\nWhen xpt_locallen exceeds xpt_remotelen, __assign_sockaddr\u0027s memcpy\\nwrites past the reserved ring-buffer slot. In the reverse direction\\n(xpt_locallen \u003c xpt_remotelen) the slot is oversized and the\\nunwritten tail leaks prior ring-buffer contents to trace consumers.\\n\\nThe write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()\\nis only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from\\nthe RDMA connect path; svc_create_socket() for UDP calls only\\nsvc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt\u0027s\\nlifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request\\nthen copies 16 or 28 bytes from xpt_local into a zero-byte slot.\\n\\nThe other NFSD tracepoints that record the server address\\n(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,\\nSVC_RQST_ENDPOINT_FIELDS) already size the server slot by\\nxpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only\\nexceptions.\\n\\nFix by sizing the server slot with xpt_locallen so the declared slot\\nmatches the copy length. The client slot and its assignment already\\nagree on xpt_remotelen and are left untouched.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"051382885552e12541cc0ebf82092be374a9ed2a\",\"lessThan\":\"95d064f9828a20ccca5ae90a17be3e2076f25272\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"051382885552e12541cc0ebf82092be374a9ed2a\",\"lessThan\":\"7ff8d6363cffff45654ea85e319f7c0c54226012\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"051382885552e12541cc0ebf82092be374a9ed2a\",\"lessThan\":\"719a10e3f5f868c3c4ac3cf3648c5775d12034bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"051382885552e12541cc0ebf82092be374a9ed2a\",\"lessThan\":\"71d068490098b1d23c63b2345e40675d3a1ca763\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcbebc86850324fbe0a993ce352f0539cd98038a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62980365d6e894234b29f44fb2bfad4f7f8bb824\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.154\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T15:02:31+00:00",
      "cve": "CVE-2026-89702",
      "id": "CVE-2026-89702",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "200",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: size fh_verify server sockaddr slot by xpt_locallen",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89702.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T23:59:51Z",
      "cve": "CVE-2026-89702",
      "id": "CVE-2026-89702",
      "initial_release_date": "2026-09-12T16:23:22Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89702",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89702.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.