{"id":"CVE-2026-89700","revision":"2634849b2a524c3b8be136fab0108176","records":[{"revision":"2634849b2a524c3b8be136fab0108176","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89700","aliases":[],"title":"nfsd: validate sockaddr length per family in listener_set","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: validate sockaddr length per family in listener_set\n\nnfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY\nattribute with no minimum length. A CAP_NET_ADMIN caller can send a\n16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte\nOOB read across three consumers (rpc_cmp_addr_port, svc_find_listener,\nkernel_bind).\n\nnfsd_nl_listener_set_doit() also parsed and validated each listener\nentry inline in two separate loops, interleaved with mutating the\nrunning listener configuration. The validation was duplicated, used an\nopen-coded \"nla_len < sizeof(struct sockaddr)\" check that was too short\nfor AF_INET6, and handled a malformed entry inconsistently depending on\nwhich loop noticed it.\n\nAdd an nfsd_nl_validate_listeners() helper that walks the entire list\nonce and confirms each entry parses, carries both an address and a\ntransport name, and is long enough for its address family\n(sizeof(struct sockaddr_in) for AF_INET, sizeof(struct sockaddr_in6)\nfor AF_INET6, -EAFNOSUPPORT otherwise). Call it before taking\nnfsd_mutex or creating the serv, so a malformed request fails cleanly\nwith no side effects.\n\nSince every entry is known valid by the time the two existing loops\nrun, drop the redundant presence and per-family length checks from\nboth, leaving only the nla_parse_nested() call needed to extract the\ndata.","state":0,"publishedAt":"2026-09-11T19:46:18.076+00:00","modifiedAt":"2026-10-19T08:51:13.379+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfsctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"16a471177496c8e04a9793812c187a2c1a2192fa\",\n                            \"lessThan\": \"bf85a0f1e45258f90ceeec14772b5769697dfd75\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16a471177496c8e04a9793812c187a2c1a2192fa\",\n                            \"lessThan\": \"2aca70c18c5f5d06004122861fb151d5fcc57faf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16a471177496c8e04a9793812c187a2c1a2192fa\",\n                            \"lessThan\": \"22d0e4752ca88fd84196d22ebeedc905e6540440\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16a471177496c8e04a9793812c187a2c1a2192fa\",\n                            \"lessThan\": \"bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfsd/nfsctl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/bf85a0f1e45258f90ceeec14772b5769697dfd75","https://git.kernel.org/stable/c/2aca70c18c5f5d06004122861fb151d5fcc57faf","https://git.kernel.org/stable/c/22d0e4752ca88fd84196d22ebeedc905e6540440","https://git.kernel.org/stable/c/bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89700","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89700","identifiers":["CVE-2026-89700"]},"retained":false,"historicalAffected":[]}],"coverage":[]}