CVE-2026-89702

In the Linux kernel, the following vulnerability has been resolved:

nfsd: size fh verify server sockaddr slot by xpt locallen

The nfsd fh verify and nfsd fh verify err tracepoints declare the server sockaddr slot sized by xpt remotelen but fill it from xpt local using xpt locallen:

TP STRUCT entry( ... sockaddr(server, rqstp->rq xprt->xpt remotelen) ... ) TP fast assign( ... assign sockaddr(server, &rqstp->rq xprt->xpt local, rqstp->rq xprt->xpt locallen); ... )

When xpt locallen exceeds xpt remotelen, assign sockaddr's memcpy writes past the reserved ring-buffer slot. In the reverse direction (xpt locallen < xpt remotelen) the slot is oversized and the unwritten tail leaks prior ring-buffer contents to trace consumers.

The write-past-end case is reachable on NFS/UDP. svc xprt set remote() is only called from svc tcp accept() (net/sunrpc/svcsock.c) and from the RDMA connect path; svc create socket() for UDP calls only svc xprt set local(), so xpt remotelen stays 0 for the xprt's lifetime. Every fh verify trace for an NFSv2/v3-over-UDP request then copies 16 or 28 bytes from xpt local into a zero-byte slot.

The other NFSD tracepoints that record the server address (NFSD TRACE PROC CALL FIELDS, NFSD TRACE PROC RES FIELDS, SVC RQST ENDPOINT FIELDS) already size the server slot by xpt locallen; nfsd fh verify and nfsd fh verify err were the only exceptions.

Fix by sizing the server slot with xpt locallen so the declared slot matches the copy length. The client slot and its assignment already agree on xpt remotelen and are left untouched.