CVE-2026-89702: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89702 Overview

CVE-2026-89702 is a memory corruption vulnerability in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which incorrectly size the server sockaddr slot using xpt_remotelen while filling it from xpt_local using xpt_locallen. This size mismatch causes __assign_sockaddr's memcpy to write past the reserved ring-buffer slot when xpt_locallen exceeds xpt_remotelen. The write-past-end condition is reachable on NFS over UDP, where xpt_remotelen remains zero for the transport's lifetime.

Critical Impact
Every fh_verify trace for an NFSv2/v3-over-UDP request copies 16 or 28 bytes from xpt_local into a zero-byte ring-buffer slot, corrupting adjacent kernel memory.

Affected Products

Linux kernel with NFS server (nfsd) support enabled
Systems serving NFSv2 or NFSv3 over UDP with tracepoint consumers active
Kernel builds prior to the fix commits referenced in the stable trees

Discovery Timeline

2026-09-11 - CVE-2026-89702 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89702

Vulnerability Analysis

The defect lives in the NFSD tracepoint definitions for file handle verification. The TP_STRUCT__entry macro reserves a sockaddr slot for the server address using rqstp->rq_xprt->xpt_remotelen, while TP_fast_assign copies data from &rqstp->rq_xprt->xpt_local using rqstp->rq_xprt->xpt_locallen bytes. When these two length values disagree, the tracepoint emits either an out-of-bounds write or an information disclosure.

All other NFSD tracepoints that record the server address, including NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS, and SVC_RQST_ENDPOINT_FIELDS, already size the server slot by xpt_locallen. Only nfsd_fh_verify and nfsd_fh_verify_err deviated from this pattern, which is what the upstream patches correct.

Root Cause

The root cause is an inconsistency between the slot allocation length and the copy length inside the tracepoint macros. svc_xprt_set_remote() is invoked only from svc_tcp_accept() in net/sunrpc/svcsock.c and from the RDMA connect path. The UDP creation path, svc_create_socket(), calls only svc_xprt_set_local(), leaving xpt_remotelen at zero for the lifetime of the UDP transport. Any subsequent NFSv2 or NFSv3 UDP request that triggers fh_verify tracing copies a full IPv4 or IPv6 sockaddr into a zero-byte allocation.

Attack Vector

The attack vector is network-based. A remote client can send NFSv2 or NFSv3 file-handle verification requests over UDP to a vulnerable server that has file-handle tracepoints enabled. Each request drives nfsd_fh_verify and writes attacker-influenced kernel context beyond the reserved ring-buffer region. In the reverse condition, where xpt_locallen < xpt_remotelen, the oversized slot leaks prior ring-buffer contents to any process consuming the trace stream. Refer to the upstream fix commits listed under Kernel Git Commit Fix for the corrected macro definitions.

Detection Methods for CVE-2026-89702

Indicators of Compromise

Unexpected kernel warnings, oopses, or ring-buffer corruption messages generated during NFS UDP traffic bursts.
Traces from nfsd_fh_verify or nfsd_fh_verify_err containing malformed or repeated sockaddr fields.
Unexplained nfsd service instability on hosts exposing NFSv2 or NFSv3 over UDP.

Detection Strategies

Audit running kernels against the fix commits 71d068490098, 719a10e3f5f8, 7ff8d6363cff, and 95d064f9828a to confirm the patched macros are present.
Inventory hosts exporting NFS over UDP (port 2049/udp) and correlate with kernel build metadata to prioritize patching.
Monitor for enablement of nfsd:nfsd_fh_verify tracepoints outside of authorized debugging windows.

Monitoring Recommendations

Alert on new listeners for NFS UDP on production servers where TCP-only was previously enforced.
Track kernel panic and dmesg telemetry for slab or ring-buffer corruption signatures following NFS activity.
Baseline access to /sys/kernel/tracing/events/nfsd/ and generate events when tracepoints are toggled.

How to Mitigate CVE-2026-89702

Immediate Actions Required

Apply the upstream stable kernel updates that resize the server sockaddr slot by xpt_locallen.
Disable NFS over UDP on exposed servers and require NFS over TCP where operationally feasible.
Restrict tracepoint access so that only privileged operators can enable nfsd tracing on production hosts.

Patch Information

The Linux kernel maintainers released the fix across multiple stable branches. Review the commits at Kernel Git Commit Fix, Kernel Git Commit Update, Kernel Git Commit Enhancement, and Kernel Git Commit Security Update. Distribution vendors are rolling the fix into their standard kernel update channels.

Workarounds

Configure /etc/nfs.conf to disable UDP transport by setting udp=n in the [nfsd] section and restart nfs-server.
Block inbound UDP to port 2049 at the host firewall until patched kernels are deployed.
Ensure nfsd file-handle tracepoints remain disabled by default and gate access to tracefs behind CAP_SYS_ADMIN.

bash

# Configuration example: disable NFS UDP and confirm tracepoints are off
sudo sed -i 's/^udp=.*/udp=n/' /etc/nfs.conf
sudo systemctl restart nfs-server
cat /sys/kernel/tracing/events/nfsd/nfsd_fh_verify/enable
sudo iptables -A INPUT -p udp --dport 2049 -j DROP