CVE-2026-89698

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where struct nfsd genl rqstp declares rq daddr and rq saddr as 16-byte struct sockaddr fields. When an IPv6 NFS client connects, the nfsd genl rpc status compose msg() function casts these fields to 28-byte struct sockaddr in6 * pointers. This causes the system to read 8 bytes beyond the end of the sockaddr field and into the adjacent rq flags member. Consequently, the nla put in6 addr function sends a truncated IPv6 address and 8 bytes of rq flags data to userspace via the NFSD A RPC STATUS SADDR6 and NFSD A RPC STATUS DADDR6 netlink attributes. This can be accessed by any unprivileged process in the network namespace because NFSD CMD RPC STATUS GET utilizes GENL CMD CAP DUMP without requiring GENL ADMIN PERM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.