Cloudanix VulnDB

CVE-2026-89698

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's NFS server code can let untrusted programs inside a network container read small pieces of internal kernel data they should not see.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in nfsd_genl_rqstp where sockaddr fields are cast to sockaddr_in6, allowing 8 bytes of adjacent rq_flags memory to be copied and leaked through NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes.

Why it matters to the business

Unprivileged processes in a network namespace can obtain fragments of kernel memory, increasing the risk of information leaks that may facilitate privilege escalation or other attacks on NFS servers.

How an attack unfolds

An attacker in the same network namespace issues the NFSD_CMD_RPC_STATUS_GET netlink command; nfsd_genl_rpc_status_compose_msg casts the undersized address fields to IPv6 structures, reads past the buffer into rq_flags, and returns the truncated address plus kernel flags to userspace.

How to fix it

Upgrade the Linux kernel to a version containing the fix that widens rq_daddr and rq_saddr to sockaddr_storage, adjusts memcpy sizes, and zero-initializes the genl_rqstp structure.

How to confirm the fix worked

Verify the kernel source contains the widened sockaddr_storage fields and zero-initialization in nfsd_genl_rqstp; confirm netlink attribute sizes match full IPv6 addresses after the patch.

Typical attack path

  1. Join or create a network namespace with access to NFSD netlink commands
  2. Send NFSD_CMD_RPC_STATUS_GET via generic netlink without elevated privileges
  3. Receive NFSD_A_RPC_STATUS_SADDR6 or DADDR6 attributes containing leaked rq_flags bytes
  4. Parse leaked kernel memory fragments for useful data to aid further exploitation

How to detect it

Inspect netlink audit logs or system call traces for NFSD_CMD_RPC_STATUS_GET invocations from non-root UIDs; correlate with processes running in network namespaces and unexpected IPv6 address attributes in userspace netlink responses.

What your security team should do

  • Apply the upstream kernel patch or distribution update that resolves the nfsd_genl_rqstp bounds issue as soon as available
  • Restrict unprivileged access to network namespaces where NFS server modules are loaded
  • Monitor for unusual NFSD netlink activity from non-root processes
  • Review systems exposing NFS over IPv6 for the presence of this kernel version

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.

Affected packages

Ecosystem Package Introduced Fixed