---
id: CVE-2026-89702
title: 'nfsd: size fh_verify server sockaddr slot by xpt_locallen'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: size fh_verify server sockaddr slot by xpt_locallen

  The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the
  server sockaddr slot sized by xpt_remotelen…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 051382885552e12541cc0ebf82092be374a9ed2a <
    1c6a4d6c20fd42552ffc2c3dfaed2139c9477ee5
  - >-
    Linux >= 051382885552e12541cc0ebf82092be374a9ed2a <
    95d064f9828a20ccca5ae90a17be3e2076f25272
  - >-
    Linux >= 051382885552e12541cc0ebf82092be374a9ed2a <
    7ff8d6363cffff45654ea85e319f7c0c54226012
  - >-
    Linux >= 051382885552e12541cc0ebf82092be374a9ed2a <
    719a10e3f5f868c3c4ac3cf3648c5775d12034bd
  - >-
    Linux >= 051382885552e12541cc0ebf82092be374a9ed2a <
    71d068490098b1d23c63b2345e40675d3a1ca763
  - Linux dcbebc86850324fbe0a993ce352f0539cd98038a
  - Linux 62980365d6e894234b29f44fb2bfad4f7f8bb824
  - Linux >= 5.15.154 < 5.16
  - Linux 6.0
published: '2026-09-11'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:48:23.372Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89702'
references:
  - url: 'https://git.kernel.org/stable/c/1c6a4d6c20fd42552ffc2c3dfaed2139c9477ee5'
  - url: 'https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272'
  - url: 'https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012'
  - url: 'https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd'
  - url: 'https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89702.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89702'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532472'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89702'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89702'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89702.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-89702'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00457
epssPercentile: 0.39484
scores:
  cna: 9.8
  vendor: 7.5
ingestedAt: '2026-09-14T15:23:07.472Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: size fh_verify server sockaddr slot by xpt_locallen

The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the
server sockaddr slot sized by xpt_remotelen but fill it from
xpt_local using xpt_locallen:

    TP_STRUCT__entry(
            ...
            __sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
            ...
    )
    TP_fast_assign(
            ...
            __assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,
                              rqstp->rq_xprt->xpt_locallen);
            ...
    )

When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy
writes past the reserved ring-buffer slot. In the reverse direction
(xpt_locallen < xpt_remotelen) the slot is oversized and the
unwritten tail leaks prior ring-buffer contents to trace consumers.

The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()
is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from
the RDMA connect path; svc_create_socket() for UDP calls only
svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's
lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request
then copies 16 or 28 bytes from xpt_local into a zero-byte slot.

The other NFSD tracepoints that record the server address
(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,
SVC_RQST_ENDPOINT_FIELDS) already size the server slot by
xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only
exceptions.

Fix by sizing the server slot with xpt_locallen so the declared slot
matches the copy length. The client slot and its assignment already
agree on xpt_remotelen and are left untouched.

## Affected

- `Linux >= 051382885552e12541cc0ebf82092be374a9ed2a < 1c6a4d6c20fd42552ffc2c3dfaed2139c9477ee5`
- `Linux >= 051382885552e12541cc0ebf82092be374a9ed2a < 95d064f9828a20ccca5ae90a17be3e2076f25272`
- `Linux >= 051382885552e12541cc0ebf82092be374a9ed2a < 7ff8d6363cffff45654ea85e319f7c0c54226012`
- `Linux >= 051382885552e12541cc0ebf82092be374a9ed2a < 719a10e3f5f868c3c4ac3cf3648c5775d12034bd`
- `Linux >= 051382885552e12541cc0ebf82092be374a9ed2a < 71d068490098b1d23c63b2345e40675d3a1ca763`
- `Linux dcbebc86850324fbe0a993ce352f0539cd98038a`
- `Linux 62980365d6e894234b29f44fb2bfad4f7f8bb824`
- `Linux >= 5.15.154 < 5.16`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89702.json)