Executive brief
The Linux kernel NFS daemon (nfsd) contains a buffer overflow vulnerability in its netlink status reporting interface. When an IPv6 NFS client connects, the code reads beyond the boundary of a network address field and exposes internal kernel memory to unprivileged processes over the network. Any user with network access can trigger this leak without special permissions, potentially exposing sensitive kernel state information.
Technical details
The vulnerability is a out-of-bounds read in the nfsd subsystem's netlink interface. The nfsd_genl_rqstp structure declares rq_daddr and rq_saddr fields as 16-byte sockaddr structs, but the code casts them to 28-byte sockaddr_in6 pointers for IPv6 addresses and reads 16 bytes of IPv6 address data starting at offset 8, which extends 8 bytes past the allocated field into the adjacent rq_flags member. The NFSD_CMD_RPC_STATUS_GET netlink command lacks GENL_ADMIN_PERM permission enforcement (uses GENL_CMD_CAP_DUMP), allowing any unprivileged process in the network namespace to query RPC status and trigger the out-of-bounds read. The nla_put_in6_addr function then transmits the truncated IPv6 address plus the leaked kernel memory bytes through NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. The fix widens the address fields to sockaddr_storage (28 bytes), updates memcpy calls to copy the full struct size, and zero-initializes the stack variable to prevent leaking uninitialized memory.
Affected products
- Linux Linux Kernel All versions with nfsd netlink support (4.20+)
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched