{"id":21624,"date":"2026-09-12T04:31:26","date_gmt":"2026-09-11T20:31:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89702"},"modified":"2026-09-12T04:31:26","modified_gmt":"2026-09-11T20:31:26","slug":"cve-2026-89702","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89702","title":{"rendered":"CVE-2026-89702 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: size fh_verify"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: size fh_verify server sockaddr slot by xpt_locallen<\/p>\n<p>The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the<br \/>\nserver sockaddr slot sized by xpt_remotelen but fill it from<br \/>\nxpt_local using xpt_locallen:<\/p>\n<p>    TP_STRUCT__entry(<br \/>\n            &#8230;<br \/>\n            __sockaddr(server, rqstp-&gt;rq_xprt-&gt;xpt_remotelen)<br \/>\n            &#8230;<br \/>\n    )<br \/>\n    TP_fast_assign(<br \/>\n            &#8230;<br \/>\n            __assign_sockaddr(server, &amp;rqstp-&gt;rq_xprt-&gt;xpt_local,<br \/>\n                              rqstp-&gt;rq_xprt-&gt;xpt_locallen);<br \/>\n            &#8230;<br \/>\n    )<\/p>\n<p>When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr&#8217;s memcpy<br \/>\nwrites past the reserved ring-buffer slot. In the reverse direction<br \/>\n(xpt_locallen &lt; xpt_remotelen) the slot is oversized and the<br \/>\nunwritten tail leaks prior ring-buffer contents to trace consumers.<\/p>\n<p>The write-past-end case is reachable on NFS\/UDP. svc_xprt_set_remote()<br \/>\nis only called from svc_tcp_accept() (net\/sunrpc\/svcsock.c) and from<br \/>\nthe RDMA connect path; svc_create_socket() for UDP calls only<br \/>\nsvc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt&#039;s<br \/>\nlifetime. Every fh_verify trace for an NFSv2\/v3-over-UDP request<br \/>\nthen copies 16 or 28 bytes from xpt_local into a zero-byte slot.<\/p>\n<p>The other NFSD tracepoints that record the server address<br \/>\n(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,<br \/>\nSVC_RQST_ENDPOINT_FIELDS) already size the server slot by<br \/>\nxpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only<br \/>\nexceptions.<\/p>\n<p>Fix by sizing the server slot with xpt_locallen so the declared slot<br \/>\nmatches the copy length. The client slot and its assignment already<br \/>\nagree on xpt_remotelen and are left untouched.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nfsd: size fh_verify server sockaddr slot by xpt_locallen<\/p>\n<p>The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the<br \/>\nserver<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21624","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}