Out-of-bounds write in Linux kernel - CVE-2026-89702

Vulnerability details

The vulnerability allows a remote attacker to write beyond a reserved trace ring-buffer slot or disclose prior ring-buffer contents.

The vulnerability exists due to an out-of-bounds write in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints when processing NFSv2/v3-over-UDP requests. A remote attacker can send an NFS/UDP request to write a server socket address into a zero-byte trace ring-buffer slot.

When the local server address is shorter than the remote address, unwritten bytes in the oversized slot can be exposed to trace consumers.

Affected software

How to mitigate CVE-2026-89702

External References

• https://git.kernel.org/stable/c/719a10e3f5f868c3c4ac3cf3648c5775d12034bd
• https://git.kernel.org/stable/c/71d068490098b1d23c63b2345e40675d3a1ca763
• https://git.kernel.org/stable/c/7ff8d6363cffff45654ea85e319f7c0c54226012
• https://git.kernel.org/stable/c/95d064f9828a20ccca5ae90a17be3e2076f25272

Related Security Bulletins

• Out-of-bounds write in Linux kernel nfsd