CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE
In the Linux kernel, the following vulnerability has been resolved:
nfsd: validate symlink target length in NFSv4 CREATE
nfsd4decodecreate() accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred.
Reject crdatalen == 0 early with nfserrinval and crdatalen greater than NFS4MAXPATHLEN (PATHMAX) with nfserrnametoolong to bound the allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel so nfsd validates symlink target length in NFSv4 CREATE: reject cr_datalen == 0 early with nfserr_inval, and reject cr_datalen > NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation and RPC payload size.
Linux kernel nfsd (NFSv4) cr_datalen validation in nfsd4_decode_create() = Reject if cr_datalen == 0 with nfserr_inval; reject if cr_datalen > NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel NFS server with NFSv4 CREATE handling exposed to clients are affected. A client able to send NFSv4 COMPOUND operations can trigger the allocation.
What does an attacker need to do to exploit it?
The attacker needs to submit an NFSv4 CREATE request for an NF4LNK symlink with an oversized target length. The supplied length can cause a kmalloc allocation up to the maximum RPC payload size before the VFS rejects the target.
What is the impact of repeated requests?
Each malicious COMPOUND operation can retain an allocation of several MiB until compound teardown. Repeated requests may create memory pressure on the NFS server.
How does the fix change request handling?
The fix rejects zero-length symlink targets with nfserr_inval and targets longer than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong. This prevents oversized target lengths from reaching the allocation path.