Out-of-bounds read in Linux kernel - CVE-2026-89705
Published: September 12, 2026
Vulnerability identifier: #VU149105
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89705
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read beyond the bounds of an inline operations array.
The vulnerability exists due to improper synchronization in nfsd_dispatch() when processing NFS requests that follow cache-hit, drop, or encode-error paths. A remote attacker can leave rq_status_counter in an odd state while nfsd_nl_rpc_status_get_dumpit() reads request fields to read beyond the bounds of an inline operations array.
Exploitation requires concurrent access by the lockless status dump reader while request fields are being mutated.
Affected software
Linux kernel
How to mitigate CVE-2026-89705
Install security update from vendor's repository.