CVE-2026-89702

A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing NFSv2/v3-over-UDP requests, the nfsd_fh_verify and nfsd_fh_verify_err tracepoints incorrectly size a memory buffer. This can lead to an out-of-bounds write, potentially allowing a remote attacker to cause a denial of service or disclose sensitive information from the kernel's ring buffer.

A server sockaddr slot size mismatch in the NFSD fh_verify tracepoints can make __assign_sockaddr copy xpt_local using xpt_locallen into space reserved with xpt_remotelen. On NFS/UDP, xpt_remotelen can remain 0 while xpt_locallen is 16 or 28 bytes, so each affected fh_verify trace event can write past the reserved ring-buffer slot. The reverse size mismatch can also expose stale ring-buffer bytes to trace consumers. For the CVSS the PR:N is used in the paranoid vector because a remote NFS client can trigger fh_verify over NFS/UDP once the service and tracepoint are reachable, although enabling the tracepoint itself is an administrative configuration. The issue is network reachable only on systems running NFSD over UDP with the affected tracepoints enabled, and NFS services are usually deployed on trusted internal networks rather than the public Internet. Impact is at least denial of service from kernel trace buffer corruption and in worst case may allow confidentiality or integrity impact due to a concrete OOB write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.