Linux nfsd: unprivileged netlink dump leaks 8 bytes of rq_flags and truncates IPv6 client addresses

Impact

struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as 16-byte struct sockaddr, but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 and reads sin6_addr at offset 8..24 - eight bytes past the field, into the adjacent rq_flags member. The netlink attribute then ships a truncated IPv6 address plus eight bytes of kernel struct contents to userspace. NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM, so any unprivileged process in the network namespace can read it - including a process inside a container that shares the host netns, which is common for NFS-serving nodes. The fix widens both fields to sockaddr_storage and zero-initializes the stack variable so uninitialized tail bytes are not leaked either.

Who can reach it

Any unprivileged local process in the network namespace of a running nfsd, with at least one IPv6 NFS client connected. No authentication or capability required.

What to do

Patch the kernel on nodes that run the in-kernel NFS server and reboot them. Nodes that only mount NFS are unaffected. If a reboot cannot be scheduled, the exposure is limited to what a local unprivileged process can read - restrict who gets shell or container workloads on the NFS server itself in the interim.

References

Related entries

• Linux nfsd: NFSD_A_SOCK_ADDR has no minimum length, giving a 12-byte out-of-bounds read in listener_setCVE-2026-89700 · Linux kernel nfsd (nfsd_nl_listener_set_doit, NFSD_A_SOCK_ADDR netlink policy)Unscored
• Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to diskCVE-2026-89701 · Linux kernel nfsd (TIME_DELEG_ACCESS/TIME_DELEG_MODIFY nseconds decode)Unscored
• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored
• Linux NFS localio: reference leak on nfs_uuid_add_file failure pins an nfsd_file and blocks netns teardownCVE-2026-89715 · Linux kernel NFS localio (nfs_open_local_fh error path, nfs_uuid_add_file)Unscored
• KVM arm64 vGICv2: guest write of an out-of-range GICV_DIR INTID triggers a host WARN and panics panic_on_warn hostsCVE-2026-89727 · Linux kernel KVM arm64 vGICv2 (GICV_DIR INTID handling)Unscored
• Linux x86/tdx: off-by-one GENMASK makes the port I/O value mask one bit too wide in a TDX guestCVE-2026-89751 · Linux kernel x86/tdx (handle_in/handle_out port I/O mask)Unscored