CVE-2026-89700

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: validate sockaddr length per family in listener_set<br /> <br /> nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY<br /> attribute with no minimum length. A CAP_NET_ADMIN caller can send a<br /> 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte<br /> OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener,<br /> kernel_bind).<br /> <br /> nfsd_nl_listener_set_doit() also parsed and validated each listener<br /> entry inline in two separate loops, interleaved with mutating the<br /> running listener configuration. The validation was duplicated, used an<br /> open-coded "nla_len