SB2026091277 - Out-of-bounds read in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-89700)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to improper length validation in the nfsd netlink listener_set handler when processing a netlink listener configuration containing a malformed socket address. A local privileged user can send a crafted listener configuration with a truncated AF_INET6 socket address to read out-of-bounds memory.

Exploitation requires the CAP_NET_ADMIN capability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/22d0e4752ca88fd84196d22ebeedc905e6540440
• https://git.kernel.org/stable/c/2aca70c18c5f5d06004122861fb151d5fcc57faf
• https://git.kernel.org/stable/c/bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464