Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace buffer

Impact

The nfsd_fh_verify and nfsd_fh_verify_err tracepoints reserve the server sockaddr slot using xpt_remotelen but fill it from xpt_local using xpt_locallen. For NFS over UDP xpt_remotelen stays zero for the transport's lifetime, so every fh_verify trace copies 16 or 28 bytes into a zero-length ring-buffer slot; in the reverse case the untouched tail of an oversized slot leaks previous ring-buffer contents to whoever reads the trace. The damage is confined to hosts that have these nfsd tracepoints enabled - an idle tracing configuration is not exposed - so on most production NFS servers this is inert until someone turns on nfsd tracing to debug something.

Who can reach it

Requires the nfsd_fh_verify tracepoints to be enabled on the server. With tracing on, any NFSv2/v3-over-UDP client request reaches the overflow; reading the leaked ring-buffer bytes needs local access to tracefs.

What to do

Take a kernel with one of the linked stable commits and reboot the NFS server. Until then, leave the nfsd_fh_verify and nfsd_fh_verify_err tracepoints disabled, which is the default, and avoid enabling them on servers still exporting NFS over UDP.

References

Related entries

• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical
• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical
• Dell OpenManage Enterprise (remote code execution): Remote code execution on the OpenManage Enterprise consoleCVE-2021-21596 · Dell OpenManage Enterprise (remote code execution)Critical
• Tailscale (Windows client): Local API bound to a TCP socketCVE-2022-41924 · Tailscale (Windows client)Critical