CVE-2026-89702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: size fh_verify server sockaddr slot by xpt_locallen

The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the

server sockaddr slot sized by xpt_remotelen but fill it from

xpt_local using xpt_locallen:

TP_STRUCT__entry(

...

__sockaddr(server, rqstp->rq_xprt->xpt_remotelen)

...

)

TP_fast_assign(

...

__assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,

rqstp->rq_xprt->xpt_locallen);

...

)

When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy

writes past the reserved ring-buffer slot. In the reverse direction

(xpt_locallen < xpt_remotelen) the slot is oversized and the

unwritten tail leaks prior ring-buffer contents to trace consumers.

The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()

is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References