CVE-2026-89698 Overview
CVE-2026-89698 is a Linux kernel vulnerability in the NFS server (nfsd) subsystem. The flaw resides in nfsd_genl_rpc_status_compose_msg(), which handles the NFSD_CMD_RPC_STATUS_GET generic netlink command. The struct nfsd_genl_rqstp type declares rq_daddr and rq_saddr as plain struct sockaddr (16 bytes), but the code casts them to struct sockaddr_in6 * (28 bytes) when an IPv6 NFS client connects. This out-of-bounds read leaks 8 bytes of adjacent rq_flags memory to userspace through the NFSD_A_RPC_STATUS_SADDR6 and NFSD_A_RPC_STATUS_DADDR6 netlink attributes.
Critical Impact
Any unprivileged process in the network namespace can trigger the leak because the netlink command uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM.
Affected Products
- Linux kernel with nfsd compiled in and generic netlink RPC status support
- Systems serving NFS traffic to IPv6 clients
- Distributions shipping kernels prior to the fix commits 03c512f, a99d720, and dcb69ad
Discovery Timeline
- 2026-09-11 - CVE-2026-89698 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89698
Vulnerability Analysis
The vulnerability is an out-of-bounds read combined with an information disclosure through the netlink interface. struct nfsd_genl_rqstp allocates 16 bytes for each of rq_daddr and rq_saddr, matching the size of struct sockaddr. When an IPv6 client is present, nfsd_genl_rpc_status_compose_msg() casts these fields to struct sockaddr_in6 * and reads sin6_addr at offsets 8 through 24. That access extends 8 bytes past the field boundary into the adjacent rq_flags member.
The subsequent call to nla_put_in6_addr copies 16 bytes into a netlink attribute. The result is 8 bytes of truncated IPv6 address followed by 8 bytes of kernel state from rq_flags shipped to userspace. Because the stack variable is not fully zero-initialized, uninitialized tail bytes may also leak through netlink.
Root Cause
The root cause is an undersized address buffer. struct sockaddr at 16 bytes cannot hold the 28-byte struct sockaddr_in6, yet the kernel casts and dereferences it as if it could. The upstream fix widens rq_daddr and rq_saddr to struct sockaddr_storage, updates memcpy sizes accordingly, and zero-initializes the stack variable to prevent leakage of uninitialized memory.
Attack Vector
Exploitation requires only local access to the network namespace. The NFSD_CMD_RPC_STATUS_GET command is exposed without GENL_ADMIN_PERM, so any unprivileged user process can issue the netlink dump. An attacker connects an IPv6 NFS client to the server, then issues the netlink request to read attacker-influenced kernel memory contents alongside the truncated address. Repeated queries can be used to sample kernel state such as rq_flags values across in-flight RPC requests.
See the fix commits for technical details: Kernel Git Commit 03c512f, Kernel Git Commit a99d720, and Kernel Git Commit dcb69ad.
Detection Methods for CVE-2026-89698
Indicators of Compromise
- Unprivileged processes issuing NFSD_CMD_RPC_STATUS_GET generic netlink dumps at unusual frequency
- IPv6 NFS client connections correlated with repeated netlink queries from non-administrative users
- Non-standard tools invoking genetlink family nfsd from user sessions
Detection Strategies
- Audit AUDIT_NETLINK events for the nfsd generic netlink family and flag issuers running outside the NFS management context
- Instrument nfsd_nl_rpc_status_get_dumpit calls via eBPF or kprobes to record caller UID and frequency
- Compare running kernel version against the fixed commits to identify unpatched hosts serving NFS
Monitoring Recommendations
- Monitor for unexpected netlink socket creation by processes not associated with NFS administration
- Track kernel version inventory across NFS servers to confirm rollout of the fix
- Alert on IPv6 NFS mounts followed by netlink activity from non-root user IDs in the same namespace
How to Mitigate CVE-2026-89698
Immediate Actions Required
- Apply the upstream Linux kernel fix that widens rq_daddr and rq_saddr to struct sockaddr_storage
- Update distribution kernels to the version incorporating commits 03c512f, a99d720, and dcb69ad
- Restrict local access on NFS servers to trusted administrative users until patching is complete
Patch Information
The fix is delivered through three upstream commits: Kernel Git Commit 03c512f, Kernel Git Commit a99d720, and Kernel Git Commit dcb69ad. The patch widens the address fields, copies sizeof(struct sockaddr_storage) bytes in the relevant memcpy calls, and zero-initializes the genl_rqstp stack variable.
Workarounds
- Disable IPv6 NFS clients where feasible so the vulnerable cast path is not exercised
- Limit local user access on NFS servers to prevent unprivileged netlink queries
- Unload the nfsd module on hosts that do not require NFS services
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.