CRITICAL
nfsd FhVerify OOB
CVE-2026-89702
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the server sockaddr slot sized by xpt_remotelen but fill it from xpt_local using xpt_locallen: TP_STRUCT__entry( ... __sockaddr(server, rqstp->rq_xprt->xpt_remotelen) ... ) TP_fast_assign( ... __assign_sockaddr(server, &rqstp->rq_xprt->xpt_local, rqstp->rq_xprt->xpt_locallen); ... ) When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past the reserved ring-buffer slot. In the reverse direction (xpt_locallen < xpt_remotelen) the slot is oversized and the unwritten tail leaks prior ring-buffer contents to trace consumers. The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote() is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from the RDMA connect path; svc_create_socket() for UDP calls only svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request then copies 16 or 28 bytes from xpt_local into a zero-byte slot. The other NFSD tracepoints that record the server address (NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, SVC_RQST_ENDPOINT_FIELDS) already size the server slot by xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only exceptions. Fix by sizing the server slot with xpt_locallen so the declared slot matches the copy length. The client slot and its assignment already agree on xpt_remotelen and are left untouched.
02KernelScan AI Analysis
Risk summary
A remote attacker who can send NFSv2/v3 requests over UDP to a server with kernel tracing enabled can trigger an out-of-bounds write in the trace ring buffer, corrupting adjacent trace data and potentially causing a kernel oops. A secondary info-leak direction exposes prior ring-buffer contents to local trace consumers. The bug only fires when tracing for the affected tracepoints is actively enabled, a debugging condition requiring privileged local access to set up.
Vulnerability analysis
The NFS server's file-handle verification tracepoints reserve a ring-buffer slot for the server's socket address using the remote address length but then fill it from the local address using the local address length. On NFS over UDP, the remote address length is never initialized, so every file-handle verification trace event copies the server's local address into a zero-length slot, writing past the reserved space and corrupting adjacent trace event data. In the reverse case, an oversized slot leaks prior ring-buffer contents to trace consumers. The fix sizes the server address slot to match the local address length so the declared space always matches the copy. The overflow is reachable by any network client that can send NFSv2 or NFSv3 requests over UDP to the server, but only fires when kernel tracing for these tracepoints is actively enabled — a debugging condition that requires privileged local access to set up.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.154 | 5.16 | 1c6a4d6c20fd |
| 6.12 | — | 6.12.109 | 7ff8d6363cff |
| 6.18 | — | 6.18.50 | 719a10e3f5f8 |
| 6.6 | — | 6.6.160 | 95d064f9828a |
| 7.2 | — | 7.2.4 | 71d068490098 |
| mainline | — | 7.3 | — |
| cip/6.12 | — | 6.12.111-cip32 | 95d064f9828a |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |