CVE-2026-89698

In the Linux kernel, the following vulnerability has been resolved:

nfsd: widen nfsd genl rqstp address fields to sockaddr storage

struct nfsd genl rqstp declares rq daddr and rq saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd genl rpc status compose msg() casts these fields to "struct sockaddr in6 *" (28 bytes) and reads sin6 addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq flags member. The 16-byte nla put in6 addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq flags to userspace via the NFSD A RPC STATUS SADDR6/DADDR6 netlink attributes.

This is reachable by any unprivileged process in the network namespace because NFSD CMD RPC STATUS GET uses GENL CMD CAP DUMP without GENL ADMIN PERM.

Fix by widening rq daddr and rq saddr to struct sockaddr storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.