Answer in brief
CVE-2026-89698 records a Unknown severity vulnerability in nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5 || >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <dcb69ad0dafb4a24b825183bb94055d5be8a10bd || >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <a99d720ed2a5258564e5e9d5f39f3184a030d354 | 03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5, dcb69ad0dafb4a24b825183bb94055d5be8a10bd, a99d720ed2a5258564e5e9d5f39f3184a030d354 |
| Linux/Linuxgeneric | 6.7 | Not reported |
| Linux/Linuxgeneric | >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <9a2e791639a1c5cac3f219b0d2632835d8f88d27 || >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5 || >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <dcb69ad0dafb4a24b825183bb94055d5be8a10bd || >=bd9d6a3efa9709e653aafbeb859289feccb8e70c <a99d720ed2a5258564e5e9d5f39f3184a030d354 | 9a2e791639a1c5cac3f219b0d2632835d8f88d27, 03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5, dcb69ad0dafb4a24b825183bb94055d5be8a10bd, a99d720ed2a5258564e5e9d5f39f3184a030d354 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.
Quoted source text, attributed separately from HOL analysis.