---
id: CVE-2026-89698
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

  struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
  "struct sockaddr" (16 bytes)
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

  struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
  "struct sockaddr" (16 bytes). When an IPv…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    9a2e791639a1c5cac3f219b0d2632835d8f88d27
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    dcb69ad0dafb4a24b825183bb94055d5be8a10bd
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    a99d720ed2a5258564e5e9d5f39f3184a030d354
  - Linux 6.7
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:25.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89698'
references:
  - url: 'https://git.kernel.org/stable/c/03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a2e791639a1c5cac3f219b0d2632835d8f88d27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a99d720ed2a5258564e5e9d5f39f3184a030d354'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dcb69ad0dafb4a24b825183bb94055d5be8a10bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89698.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89698'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532229'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89698'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89698'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89698.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.002
epssPercentile: 0.10125
cvssSource: vendor
ingestedAt: '2026-09-14T11:11:19.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage

struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
"struct sockaddr" (16 bytes). When an IPv6 NFS client is connected,
nfsd_genl_rpc_status_compose_msg() casts these fields to
"struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24,
which extends 8 bytes past the end of the 16-byte sockaddr field into
the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8
bytes of truncated IPv6 address followed by 8 bytes of rq_flags to
userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes.

This is reachable by any unprivileged process in the network namespace
because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without
GENL_ADMIN_PERM.

Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the
IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage)
bytes in the memcpy calls so the full address is captured, and
zero-initializing the genl_rqstp stack variable to prevent leaking
uninitialized tail bytes through netlink.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89698.json)