HIGH Introduced in 2.6.12
nfsd SymlinkTarget Exhaustion
CVE-2026-89699
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred. Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.
02KernelScan AI Analysis
Risk summary
A remote NFS client can send a crafted NFSv4 CREATE operation with an unbounded symlink target length, forcing the server to allocate up to several MiB per COMPOUND request that persists until request teardown. Repeated requests can exhaust server memory and cause denial of service. Any host with network access to the NFS server can trigger this without special credentials.
Vulnerability analysis
The NFS server's NFSv4 CREATE decoder reads a symlink target length from the wire without bounding it, then allocates memory of that attacker-controlled size before the VFS ever validates the target. A malicious client can specify a length up to the maximum RPC payload size, causing a multi-MiB allocation per COMPOUND operation that lives until compound teardown; the VFS eventually rejects the oversized target, but the allocation has already happened and can be repeated to exhaust server memory. The fix adds early validation that rejects zero-length targets and targets exceeding PATH_MAX before any allocation occurs. Any network client that can reach the NFS server can trigger this — no special privileges are needed beyond the ability to send NFSv4 RPC requests.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 2.6.12 | 7.3-rc1 | 041f57056e5f |
| 5.10 | 2.6.12 | 5.10.270 | 36011308b3f0 |
| 6.12 | 2.6.12 | 6.12.109 | b24843ea3de1 |
| 7.2 | 2.6.12 | 7.2.4 | 45ec115cbfec |
| 6.6 | 2.6.12 | 6.6.157 | 3ef5e7a01a4d |
| 6.1 | 2.6.12 | 6.1.188 | 8661d3cb38fd |
| 5.15 | 2.6.12 | 5.15.221 | 888dad4b5573 |
| 6.18 | 2.6.12 | 6.18.50 | 895a485cd375 |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | b24843ea3de1 |