{"id":"CVE-2026-89698","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage\n\nstruct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain\n\"struct sockaddr\" (16 bytes)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage\n\nstruct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain\n\"struct sockaddr\" (16 bytes). When an IPv…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < 9a2e791639a1c5cac3f219b0d2632835d8f88d27","Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < 03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5","Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < dcb69ad0dafb4a24b825183bb94055d5be8a10bd","Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < a99d720ed2a5258564e5e9d5f39f3184a030d354","Linux 6.7"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:25.457","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89698","references":[{"url":"https://git.kernel.org/stable/c/03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a2e791639a1c5cac3f219b0d2632835d8f88d27","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a99d720ed2a5258564e5e9d5f39f3184a030d354","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcb69ad0dafb4a24b825183bb94055d5be8a10bd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89698.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89698"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532229"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89698"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89698"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89698.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00198,"epssPercentile":0.09827,"cvssSource":"vendor","ingestedAt":"2026-09-14T11:11:19.885Z","slug":"CVE-2026-89698","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage\n\nstruct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain\n\"struct sockaddr\" (16 bytes). When an IPv6 NFS client is connected,\nnfsd_genl_rpc_status_compose_msg() casts these fields to\n\"struct sockaddr_in6 *\" (28 bytes) and reads sin6_addr at offset 8..24,\nwhich extends 8 bytes past the end of the 16-byte sockaddr field into\nthe adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8\nbytes of truncated IPv6 address followed by 8 bytes of rq_flags to\nuserspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes.\n\nThis is reachable by any unprivileged process in the network namespace\nbecause NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without\nGENL_ADMIN_PERM.\n\nFix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the\nIPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage)\nbytes in the memcpy calls so the full address is captured, and\nzero-initializing the genl_rqstp stack variable to prevent leaking\nuninitialized tail bytes through netlink.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89698.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204049,"id":"CVE-2026-89698","ts":1789490231197,"field":"cvss","old":null,"new":"6.5"},{"seq":204048,"id":"CVE-2026-89698","ts":1789490231197,"field":"severity","old":"none","new":"medium"},{"seq":147592,"id":"CVE-2026-89698","ts":1789270211516,"field":"cvss","old":null,"new":"6.5"},{"seq":147591,"id":"CVE-2026-89698","ts":1789270211516,"field":"severity","old":"none","new":"medium"},{"seq":109338,"id":"CVE-2026-89698","ts":1789183731494,"field":"cvss","old":null,"new":"6.5"},{"seq":109337,"id":"CVE-2026-89698","ts":1789183731494,"field":"severity","old":"none","new":"medium"}]}