CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate symlink target length in NFSv4 CREATE

nfsd4 decode create() accepts an unbounded cr datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred.

Reject cr datalen == 0 early with nfserr inval and cr datalen greater than NFS4 MAXPATHLEN (PATH MAX) with nfserr nametoolong to bound the allocation.