The Linux kernel's NFS daemon tracepoints nfsd_fh_verify and nfsd_fh_verify_err declared a server sockaddr slot sized by xpt_remotelen but copied data from xpt_local using xpt_locallen. When xpt_locallen is larger than xpt_remotelen, memcpy writes beyond the reserved buffer, causing a buffer overflow. Conversely, if xpt_locallen is smaller, leftover buffer contents may leak. This flaw is reachable on NFS over UDP because the remote length remains zero, causing a zero-byte slot but copying 16 or 28 bytes. Other NFSD tracepoints correctly size the slot by xpt_locallen. The fix aligns the slot size with xpt_locallen to prevent overflow and leaks.

The vulnerability can cause a buffer overflow in kernel tracepoints, potentially leading to memory corruption or information leakage through trace consumers. It specifically affects NFSv2/v3 over UDP. No known exploits in the wild have been reported. The impact is limited to kernel tracing functionality related to NFS server address logging.

A fix has been implemented in the Linux kernel to size the server sockaddr slot by xpt_locallen, matching the copy length and preventing buffer overflow and data leakage. Users should apply the official kernel update containing this fix. No additional mitigation is required beyond applying the patch.