The Linux kernel's nfsd_genl_rqstp structure originally declared rq_daddr and rq_saddr as 16-byte sockaddr structs. When handling IPv6 NFS clients, these fields were cast to 28-byte sockaddr_in6 pointers, causing reads beyond the allocated 16 bytes into adjacent memory (rq_flags). This out-of-bounds read resulted in truncated IPv6 addresses combined with unintended rq_flags data being sent to userspace via netlink attributes. The vulnerability is reachable by any unprivileged process in the network namespace due to insufficient permission checks on the NFSD_CMD_RPC_STATUS_GET command. The fix involved widening rq_daddr and rq_saddr to sockaddr_storage, copying the full address size, and zero-initializing the relevant stack variable to prevent leaking uninitialized data.

Unprivileged processes in the network namespace could read beyond intended memory boundaries, potentially leaking kernel memory contents adjacent to the address fields via netlink attributes. This could expose sensitive kernel data to unprivileged userspace processes. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel by widening the address fields to sockaddr_storage and zero-initializing memory to prevent leakage. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or Linux kernel advisories for the specific fixed versions and apply updates accordingly.