CVE-2026-89702

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nfsd component where the nfsd fh verify and nfsd fh verify err tracepoints incorrectly size the server sockaddr slot using xpt remotelen while filling it from xpt local using xpt locallen. When xpt locallen exceeds xpt remotelen, the assign sockaddr() function performs a memcpy that writes past the reserved ring-buffer slot. This condition is reachable on NFS/UDP because xpt remotelen remains 0 for the lifetime of the xprt, causing 16 or 28 bytes to be copied into a zero-byte slot for every fh verify trace of an NFSv2/v3-over-UDP request. Conversely, if xpt locallen is smaller than xpt remotelen, the oversized slot may leak prior ring-buffer contents to trace consumers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.