SB2026091282 - Out-of-bounds read in Linux kernel nfsd

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-89705)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of an inline operations array.

The vulnerability exists due to improper synchronization in nfsd_dispatch() when processing NFS requests that follow cache-hit, drop, or encode-error paths. A remote attacker can leave rq_status_counter in an odd state while nfsd_nl_rpc_status_get_dumpit() reads request fields to read beyond the bounds of an inline operations array.

Exploitation requires concurrent access by the lockless status dump reader while request fields are being mutated.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/b08c30f08d57f30699d36809d92f0b683dca261f
• https://git.kernel.org/stable/c/f6045886fe3f14f269f683d64021b004a50d0efa