CVE-2026-89700 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: validate sockaddr length per family in listener_set
nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller can send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).
nfsd_nl_listener_set_doit() also parsed and validated each listener entry inline in two separate loops, interleaved with mutating the running listener configuration. The validation was duplicated, used an open-coded "nla_len < sizeof(struct sockaddr)" check that was too short for AF_INET6, and handled a malformed entry inconsistently depending on which loop noticed it.
Add an nfsd_nl_validate_listeners() helper that walks the entire list once and confirms each entry parses, carries both an address and a transport name, and is long enough for its address family (sizeof(struct sockaddr_in) for AF_INET, sizeof(struct sockaddr_in6) for AF_INET6, -EAFNOSUPPORT otherwise). Call it before taking nfsd_mutex or creating the serv, so a malformed request fails cleanly with no side effects.
Since every entry is known valid by the time the two existing loops run, drop the redundant presence and per-family length checks from both, leaving only the nla_parse_nested() call needed to extract the data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel vulnerability identified in the NFS server daemon (nfsd) subsystem involves a critical input validation flaw within the netlink listener configuration interface. Specifically, the attribute definition for NFSD_A_SOCK_ADDR was declared as a bare NLA_BINARY type without enforcing any minimum length constraints. This oversight allowed an attacker with CAP_NET_ADMIN privileges to submit a malformed request containing a socket address structure that did not match the expected size for its specified family. When such a request included an IPv6 address, indicated by sa_family set to AF_INET6, the kernel failed to verify that the provided data was sufficiently large to contain a full struct sockaddr_in6. This lack of validation led directly to out-of-bounds read conditions across three distinct code paths: rpc_cmp_addr_port, svc_find_listener, and kernel_bind. These functions attempted to access memory beyond the bounds of the allocated buffer, potentially exposing sensitive kernel information or causing undefined behavior depending on the surrounding memory state.
The root cause of this vulnerability lies in the architectural design of the nfsd_nl_listener_set_doit function, which handled validation and mutation concurrently rather than separating concerns. The original implementation parsed and validated each listener entry inline within two separate loops that were interleaved with operations mutating the running listener configuration. This approach resulted in duplicated logic where one loop performed presence checks while another attempted length verification using an open-coded comparison against sizeof(struct sockaddr). Since struct sockaddr is a generic base structure, this check was insufficient for IPv6 addresses which require significantly more space than their IPv4 counterparts. Consequently, malformed entries were handled inconsistently; the error might be detected by one loop or ignored until later processing stages, leading to unpredictable side effects and potential security breaches before any corrective action could be taken.
To remediate this issue, a dedicated helper function named nfsd_nl_validate_listeners was introduced to centralize and enforce strict input validation rules. This new routine walks the entire list of listeners exactly once prior to acquiring the nfsd_mutex or creating the server instance, ensuring that no side effects occur if validation fails. The validator confirms that each entry contains both a valid address and a transport name, while also enforcing family-specific length requirements. It explicitly checks for sizeof(struct sockaddr_in) when the address family is AF_INET and sizeof(struct sockaddr_in6) when it is AF_INET6, returning an EAFNOSUPPORT error for unsupported families. By moving this validation to occur before any state changes, the system ensures that malformed requests are rejected cleanly without altering kernel configuration or exposing memory through out-of-bounds reads.
From a security classification perspective, this vulnerability aligns with CWE-125 Out-of-Bounds Read and CWE-20 Improper Input Validation within the Common Weakness Enumeration framework. The ability of an authenticated local user to trigger these conditions via CAP_NET_ADMIN maps to MITRE ATT&CK technique T1078 Valid Accounts, as it exploits legitimate administrative privileges to probe kernel memory boundaries. The fix exemplifies secure coding practices by separating validation from execution logic and ensuring atomicity in configuration changes. Organizations running affected Linux kernels should apply the relevant patch immediately to prevent potential information disclosure or stability issues arising from malformed netlink messages targeting the NFS server listener management interface.