CVE-2026-89702
Description
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing NFSv2/v3-over-UDP requests, the nfsd_fh_verify and nfsd_fh_verify_err tracepoints incorrectly size a memory buffer. This can lead to an out-of-bounds write, potentially allowing a remote attacker to cause a denial of service or disclose sensitive information from the kernel's ring buffer.
Statement
A server sockaddr slot size mismatch in the NFSD fh_verify tracepoints can make __assign_sockaddr copy xpt_local using xpt_locallen into space reserved with xpt_remotelen. On NFS/UDP, xpt_remotelen can remain 0 while xpt_locallen is 16 or 28 bytes, so each affected fh_verify trace event can write past the reserved ring-buffer slot. The reverse size mismatch can also expose stale ring-buffer bytes to trace consumers. For the CVSS the PR:N is used in the paranoid vector because a remote NFS client can trigger fh_verify over NFS/UDP once the service and tracepoint are reachable, although enabling the tracepoint itself is an administrative configuration. The issue is network reachable only on systems running NFSD over UDP with the affected tracepoints enabled, and NFS services are usually deployed on trusted internal networks rather than the public Internet. Impact is at least denial of service from kernel trace buffer corruption and in worst case may allow confidentiality or integrity impact due to a concrete OOB write primitive.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
