CVE-2026-89702

In the Linux kernel, the following vulnerability has been resolved:

nfsd: size fh_verify server sockaddr slot by xpt_locallen

The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the

server sockaddr slot sized by xpt_remotelen but fill it from

xpt_local using xpt_locallen:

TP_STRUCT__entry(

...

__sockaddr(server, rqstp->rq_xprt->xpt_remotelen)

...

)

TP_fast_assign(

...

__assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,

rqstp->rq_xprt->xpt_locallen);

...

)

When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy

writes past the reserved ring-buffer slot. In the reverse direction

(xpt_locallen < xpt_remotelen) the slot is oversized and the

unwritten tail leaks prior ring-buffer contents to trace consumers.

The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()

is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from

the RDMA connect path; svc_create_socket() for UDP calls only

svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's

lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request

then copies 16 or 28 bytes from xpt_local into a zero-byte slot.

The other NFSD tracepoints that record the server address

(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,

SVC_RQST_ENDPOINT_FIELDS) already size the server slot by

xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only

exceptions.

Fix by sizing the server slot with xpt_locallen so the declared slot

matches the copy length. The client slot and its assignment already

agree on xpt_remotelen and are left untouched.