CVE-2026-89700

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate sockaddr length per family in listener_set

nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY

attribute with no minimum length. A CAP_NET_ADMIN caller can send a

16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte

OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener,

kernel_bind).

nfsd_nl_listener_set_doit() also parsed and validated each listener

entry inline in two separate loops, interleaved with mutating the

running listener configuration. The validation was duplicated, used an

open-coded "nla_len < sizeof(struct sockaddr)" check that was too short

for AF_INET6, and handled a malformed entry inconsistently depending on

which loop noticed it.

Add an nfsd_nl_validate_listeners() helper that walks the entire list

once and confirms each entry parses, carries both an address and a

transport name, and is long enough for its address family

(sizeof(struct

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References