Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-89699 Details

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred. Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/041f57056e5fb9c80adc088269322d2c61074406 kernel.org
https://git.kernel.org/stable/c/36011308b3f01ce7dc9954f3cefcbb5291af9f95 kernel.org
https://git.kernel.org/stable/c/3ef5e7a01a4d74995a65496bc9166d1e980a4355 kernel.org
https://git.kernel.org/stable/c/45ec115cbfecb4b3cfab7fca6f73d1b60696a25a kernel.org
https://git.kernel.org/stable/c/8661d3cb38fd148947e57dbc0871fd4d3fa33bbf kernel.org

see all 8 references

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-89699
NVD Published Date:
Sep 11, 2026
NVD Last Modified:
Sep 14, 2026
Source:
kernel.org
CVE-2026-89699 Details - Not Deferred