CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
In the Linux kernel, the following vulnerability has been resolved:
nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage
struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg() casts these fields to "struct sockaddrin6 " (28 bytes) and reads sin6addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rqflags member. The 16-byte nlaputin6addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rqflags to userspace via the NFSDARPCSTATUSSADDR6/DADDR6 netlink attributes.
This is reachable by any unprivileged process in the network namespace because NFSDCMDRPCSTATUSGET uses GENLCMDCAPDUMP without GENLADMINPERM.
Fix by widening rqdaddr and rqsaddr to struct sockaddrstorage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddrstorage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genlrqstp stack variable to prevent leaking uninitialized tail bytes through netlink.
Affected Software
Event History
Frequently Asked Questions
Who can retrieve the leaked data?
Any unprivileged process in the relevant network namespace can reach the RPC status dump command. The command does not require the generic-netlink administrative permission.
What conditions are required for disclosure?
An IPv6 NFS client must be connected so that the affected code treats the stored addresses as IPv6 socket addresses. The resulting netlink IPv6 source or destination address attribute contains a truncated address followed by bytes from the adjacent rq_flags field.
What can be done before applying the fix?
Restrict unprivileged processes' ability to operate in network namespaces where the NFS server is exposed, and avoid exposing IPv6 NFS client connections where feasible. The provided data does not identify a configuration switch that disables only this RPC status query.
How can I determine whether an affected system is exposing the issue?
Check whether the kernel contains the described fix: the request address fields are sockaddr_storage, the associated copies use sizeof(struct sockaddr_storage), and the genl_rqstp stack variable is zero-initialized. On an unfixed kernel, querying NFSD RPC status for an IPv6 NFS client can return malformed IPv6 address attributes containing rq_flags data.