Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-11T00:00:00 kernel: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.

A flaw was found in the Linux kernel's nfsd component. When an IPv6 NFS client is connected, the `nfsd_genl_rpc_status_compose_msg()` function incorrectly handles address fields, leading to an out-of-bounds read. A local unprivileged attacker can exploit this vulnerability to disclose sensitive kernel memory information, specifically 8 bytes of truncated IPv6 address and 8 bytes of kernel stack data, to userspace.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 10 Affected kernel-rt Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89698 https://nvd.nist.gov/vuln/detail/CVE-2026-89698 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89698.mbox