Executive brief
The Linux kernel's NFS daemon (NFSD) contains a flaw in how it validates network socket listener configuration via netlink commands. A privileged local user can send malformed socket address data that causes the kernel to read 12 bytes beyond allocated memory, potentially exposing sensitive kernel data or triggering a crash. This affects systems running NFSD with netlink listener management enabled.
Technical details
The vulnerability is an out-of-bounds (OOB) read in NFSD's netlink listener configuration handler. The nfsd_sock_nl_policy defined NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length validation. A CAP_NET_ADMIN caller could send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, triggering a 12-byte OOB read across three kernel functions (rpc_cmp_addr_port, svc_find_listener, kernel_bind). Additionally, validation was duplicated and insufficient (using "nla_len < sizeof(struct sockaddr)" which is too short for AF_INET6). The fix adds a nfsd_nl_validate_listeners() helper that validates all listener entries before any mutations occur, ensuring each entry has the correct minimum length for its address family (16 bytes for IPv4, 28 bytes for IPv6).
Affected products
- Linux Linux Kernel Affected versions from kernel 4.x through 6.x (fixed in multiple stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89700 published on NVD
- 2026-06-15: patched: Fix committed by Jeff Layton (commit bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464)
- 2026-09-07: other: Patch merged into stable kernel trees by Greg Kroah-Hartman