Executive brief
The Linux kernel's NFSv4 server implementation (nfsd) fails to validate symlink target length when processing CREATE requests, allowing a remote attacker to force the allocation of several megabytes of kernel memory per operation. While the VFS layer eventually rejects oversized paths, the memory has already been allocated and persists until the entire NFSv4 compound operation completes, potentially exhausting system memory and causing denial of service.
Technical details
The vulnerability exists in nfsd4_decode_create() which accepts an unbounded cr_datalen value from the network for NF4LNK (symlink) targets without validation. This allows a malicious NFSv4 client to request kernel memory allocation (kmalloc) up to the maximum RPC payload size (several megabytes) per COMPOUND operation. Although the VFS layer rejects oversized paths with ENAMETOOLONG, the memory has already been allocated and held until compound teardown. The fix adds two validation checks: rejecting cr_datalen == 0 with nfserr_inval and cr_datalen > NFS4_MAXPATHLEN with nfserr_nametoolong, bounding allocations to safe limits. This is a network-reachable vulnerability affecting any system running the vulnerable kernel with NFSv4 server enabled; no authentication or elevated privileges are required.
Affected products
- Linux Linux kernel 2.6.12 and later (all versions prior to fix)
Timeline
- 2026-09-11: disclosed: CVE-2026-89699 published
- 2026-05-30: patched: Fix committed by Jeff Layton (commit 041f57056e5fb9c80adc088269322d2c61074406)
- 2026-09-14: patched: Fix merged to stable tree