Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND op

Impact

nfsd4_decode_create() accepted an unbounded cr_datalen for NF4LNK targets, so each CREATE op in a COMPOUND can pin a kmalloc up to the maximum RPC payload (several MiB) until compound teardown, even though the VFS later rejects the path with ENAMETOOLONG. A client that pipelines such compounds drives server kernel memory pressure and can degrade or kill the NFS service that a whole GPU cluster reads datasets and writes checkpoints through. The fix rejects cr_datalen of zero and anything above NFS4_MAXPATHLEN before allocating. Availability impact only.

Who can reach it

Any authenticated NFSv4 client that can mount the export with write access to some directory, i.e. any tenant node or pod holding a normal mount.

What to do

Deploy a kernel containing the length validation (stable commits 041f57056e5f, 45ec115cbfec, 895a485cd375, b24843ea3de1) and reboot the NFS server node. No configuration-level mitigation is documented; limiting which clients can mount the export is the only interim reduction.

References

Related entries

• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High
• Linux kernel nfsd: write verifier not rotated when async COPY writeback fails, so COMMIT confirms lost dataCVE-2026-89706 · Linux kernel nfsd (async COPY write verifier rotation, nn->writeverf)High
• Linux kernel nfsd: failed cross-mount leaks mount and dentry references on the NFS serverCVE-2026-89707 · Linux kernel nfsd (nfsd_cross_mnt, follow_down() error path refcount leak)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
• HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High