CVE-2026-89698

A flaw was found in the Linux kernel's nfsd component. When an IPv6 NFS client is connected, the nfsd_genl_rpc_status_compose_msg() function incorrectly handles address fields, leading to an out-of-bounds read. A local unprivileged attacker can exploit this vulnerability to disclose sensitive kernel memory information, specifically 8 bytes of truncated IPv6 address and 8 bytes of kernel stack data, to userspace.

An out of bounds read in the nfsd rpc_status generic netlink dump can occur because rq_daddr and rq_saddr were stored as 16 byte sockaddr fields but later interpreted as 28 byte IPv6 sockaddr_in6 objects. When an IPv6 NFS client is present, nfsd_genl_rpc_status_compose_msg() may read past the end of the address field and include adjacent structure bytes such as rq_flags or uninitialized tail data in NFSD_A_RPC_STATUS_SADDR6 or NFSD_A_RPC_STATUS_DADDR6 attributes. For the CVSS the PR:L is used because a local unprivileged process in the network namespace can request NFSD_CMD_RPC_STATUS_GET through generic netlink without GENL_ADMIN_PERM. The issue is local rather than directly network reachable, although an IPv6 NFS client connection is part of the affected state. Impact is information disclosure from kernel memory to userspace. There is no direct evidence of integrity impact, availability impact, or privilege escalation from this patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.