CVE-2026-89699

nfsd: validate symlink target length in NFSv4 CREATE

State: Published
Severity: 7.5 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate symlink target length in NFSv4 CREATE

nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred.

Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 36011308b3f01ce7dc9954f3cefcbb5291af9f95Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 888dad4b557352cf85be31613407b5ba51ad07d1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8661d3cb38fd148947e57dbc0871fd4d3fa33bbfAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ef5e7a01a4d74995a65496bc9166d1e980a4355Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b24843ea3de1676b29902457b38507c95a80649bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 895a485cd3758031ef9993c0d53cf19ce8fb4cccAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 45ec115cbfecb4b3cfab7fca6f73d1b60696a25aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 041f57056e5fb9c80adc088269322d2c61074406Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 36011308b3f01ce7dc9954f3cefcbb5291af9f95Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 888dad4b557352cf85be31613407b5ba51ad07d1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8661d3cb38fd148947e57dbc0871fd4d3fa33bbfAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ef5e7a01a4d74995a65496bc9166d1e980a4355Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b24843ea3de1676b29902457b38507c95a80649bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 895a485cd3758031ef9993c0d53cf19ce8fb4cccAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 45ec115cbfecb4b3cfab7fca6f73d1b60696a25aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 041f57056e5fb9c80adc088269322d2c61074406Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.