Linux nfsd: NFSD_A_SOCK_ADDR has no minimum length, giving a 12-byte out-of-bounds read in listener_set

Impact

nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as bare NLA_BINARY with no minimum length, so a caller could send a 16-byte address with sa_family=AF_INET6 and cause a 12-byte out-of-bounds read across rpc_cmp_addr_port, svc_find_listener and kernel_bind. The listener configuration was also validated inline in two separate loops interleaved with mutating the running config, so a malformed entry was handled inconsistently and could leave the server's listeners half-changed. The gating capability is CAP_NET_ADMIN, which makes this a hardening fix rather than a tenant-reachable bug - but it matters on nodes where a container or automation holds CAP_NET_ADMIN in the host network namespace. The fix adds nfsd_nl_validate_listeners(), which walks the whole list before taking nfsd_mutex so a malformed request fails with no side effects.

Who can reach it

Local caller holding CAP_NET_ADMIN in the network namespace of the NFS server - root, or a privileged container with that capability. Not reachable by an ordinary tenant or by a remote NFS client.

What to do

Patch the kernel on in-kernel NFS server nodes and reboot. Low urgency given the CAP_NET_ADMIN requirement; fold it into the next scheduled kernel roll rather than opening a window for it. In the meantime, audit which workloads on the NFS server hold CAP_NET_ADMIN in the host netns.

References

Related entries

• Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to diskCVE-2026-89701 · Linux kernel nfsd (TIME_DELEG_ACCESS/TIME_DELEG_MODIFY nseconds decode)Unscored
• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored
• Linux NFS localio: reference leak on nfs_uuid_add_file failure pins an nfsd_file and blocks netns teardownCVE-2026-89715 · Linux kernel NFS localio (nfs_open_local_fh error path, nfs_uuid_add_file)Unscored
• KVM arm64 vGICv2: guest write of an out-of-range GICV_DIR INTID triggers a host WARN and panics panic_on_warn hostsCVE-2026-89727 · Linux kernel KVM arm64 vGICv2 (GICV_DIR INTID handling)Unscored
• Linux x86/tdx: off-by-one GENMASK makes the port I/O value mask one bit too wide in a TDX guestCVE-2026-89751 · Linux kernel x86/tdx (handle_in/handle_out port I/O mask)Unscored
• Linux memcg: concurrent memory.max writers reclaim toward a stale target and can loop indefinitelyCVE-2026-89752 · Linux kernel memcg (memory.high / memory.max writer reclaim loop)Unscored