---
id: CVE-2026-89699
title: 'nfsd: validate symlink target length in NFSv4 CREATE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: validate symlink target length in NFSv4 CREATE

  nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for
  NF4LNK symlink targets, allowing a client …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    36011308b3f01ce7dc9954f3cefcbb5291af9f95
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    888dad4b557352cf85be31613407b5ba51ad07d1
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8661d3cb38fd148947e57dbc0871fd4d3fa33bbf
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3ef5e7a01a4d74995a65496bc9166d1e980a4355
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b24843ea3de1676b29902457b38507c95a80649b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    895a485cd3758031ef9993c0d53cf19ce8fb4ccc
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    45ec115cbfecb4b3cfab7fca6f73d1b60696a25a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    041f57056e5fb9c80adc088269322d2c61074406
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T19:26:10.914842Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:12.396Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89699'
references:
  - url: 'https://git.kernel.org/stable/c/36011308b3f01ce7dc9954f3cefcbb5291af9f95'
  - url: 'https://git.kernel.org/stable/c/888dad4b557352cf85be31613407b5ba51ad07d1'
  - url: 'https://git.kernel.org/stable/c/8661d3cb38fd148947e57dbc0871fd4d3fa33bbf'
  - url: 'https://git.kernel.org/stable/c/3ef5e7a01a4d74995a65496bc9166d1e980a4355'
  - url: 'https://git.kernel.org/stable/c/b24843ea3de1676b29902457b38507c95a80649b'
  - url: 'https://git.kernel.org/stable/c/895a485cd3758031ef9993c0d53cf19ce8fb4ccc'
  - url: 'https://git.kernel.org/stable/c/45ec115cbfecb4b3cfab7fca6f73d1b60696a25a'
  - url: 'https://git.kernel.org/stable/c/041f57056e5fb9c80adc088269322d2c61074406'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89699.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89699'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532157'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89699'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89699'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89699.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00501
epssPercentile: 0.42713
scores:
  cna: 7.5
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate symlink target length in NFSv4 CREATE

nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for
NF4LNK symlink targets, allowing a client to force a kmalloc of up to
the maximum RPC payload size (several MiB) per COMPOUND op that persists
until compound teardown.  The VFS rejects oversized targets with
ENAMETOOLONG, but the allocation has already occurred.

Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater
than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the
allocation.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 36011308b3f01ce7dc9954f3cefcbb5291af9f95`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 888dad4b557352cf85be31613407b5ba51ad07d1`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8661d3cb38fd148947e57dbc0871fd4d3fa33bbf`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3ef5e7a01a4d74995a65496bc9166d1e980a4355`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b24843ea3de1676b29902457b38507c95a80649b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 895a485cd3758031ef9993c0d53cf19ce8fb4ccc`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 45ec115cbfecb4b3cfab7fca6f73d1b60696a25a`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 041f57056e5fb9c80adc088269322d2c61074406`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89699.json)