UBUNTU-CVE-2026-89698: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg() casts these fields to "struct sockaddrin6 " (28 bytes) and reads sin6addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rqflags member. The 16-byte nlaputin6addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rqflags to userspace via the NFSDARPCSTATUSSADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSDCMDRPCSTATUSGET uses GENLCMDCAPDUMP without GENLADMINPERM. Fix by widening rqdaddr and rqsaddr to struct sockaddrstorage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddrstorage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genlrqstp stack variable to prevent leaking uninitialized tail bytes through netlink.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel nfsd_genl_rqstp implementation, widen rq_daddr and rq_saddr from struct sockaddr to struct sockaddr_storage, copy sizeof(struct sockaddr_storage) bytes in the memcpy calls, and zero-initialize the genl_rqstp stack variable to prevent uninitialized tail-byte disclosure through netlink.