Cloudanix VulnDB

CVE-2026-89700

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux NFS server lets a privileged local user send a badly sized network address that can crash the server or peek at nearby memory.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Insufficient length validation on NFSD_A_SOCK_ADDR NLA_BINARY attribute allows a CAP_NET_ADMIN process to supply a 16-byte AF_INET6 address that triggers a 12-byte out-of-bounds read inside rpc_cmp_addr_port, svc_find_listener and kernel_bind when nfsd processes a netlink listener configuration request.

Why it matters to the business

A local administrator can crash the NFS server or read adjacent kernel memory, causing denial of service for file-sharing workloads and possible information disclosure on systems that expose nfsd netlink interfaces.

How an attack unfolds

An attacker with CAP_NET_ADMIN sends a netlink message containing a deliberately short sockaddr_in6 structure through the nfsd listener configuration path. The missing per-family length check in nfsd_sock_nl_policy and the duplicated inline validation loops allow the malformed address to reach three consumers that perform pointer arithmetic beyond the supplied buffer.

How to fix it

Apply the upstream kernel commit that introduces nfsd_nl_validate_listeners, enforces correct minimum lengths per address family, and removes the duplicated validation loops. Rebuild and reboot any system running an affected nfsd build.

How to confirm the fix worked

Confirm the presence of nfsd_nl_validate_listeners in the kernel source or verify that nla_policy declarations now include correct .len values for NFSD_A_SOCK_ADDR; test by attempting to configure an AF_INET6 listener with a truncated address and confirm the request is rejected with -EINVAL before any mutation occurs.

Typical attack path

  1. Obtain CAP_NET_ADMIN capability on the target host
  2. Craft a netlink NLMSG with NFSD_A_SOCK_ADDR set to 16 bytes and sa_family=AF_INET6
  3. Invoke nfsd_nl_listener_set_doit via the nfsd netlink family
  4. Trigger the three consumers that dereference past the end of the supplied sockaddr
  5. Observe kernel oops, memory disclosure or service restart

How to detect it

Search kernel logs for oopses referencing rpc_cmp_addr_port, svc_find_listener or kernel_bind during nfsd netlink processing; inspect audit records of netlink messages sent to the nfsd family by processes holding CAP_NET_ADMIN.

What your security team should do

  • Prioritize patching kernel packages that contain nfsd netlink listener code
  • Restrict CAP_NET_ADMIN to trusted processes only
  • Monitor for unexpected nfsd restarts or kernel logs containing rpc_cmp_addr_port or svc_find_listener oopses

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller can send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind). nfsd_nl_listener_set_doit() also parsed and validated each listener entry inline in two separate loops, interleaved with mutating the running listener configuration. The validation was duplicated, used an open-coded "nla_len < sizeof(struct sockaddr)" check that was too short for AF_INET6, and handled a malformed entry inconsistently depending on which loop noticed it. Add an nfsd_nl_validate_listeners() helper that walks the entire list once and confirms each entry parses, carries both an address and a transport name, and is long enough for its address family (sizeof(struct sockaddr_in) for AF_INET, sizeof(struct sockaddr_in6) for AF_INET6, -EAFNOSUPPORT otherwise). Call it before taking nfsd_mutex or creating the serv, so a malformed request fails cleanly with no side effects. Since every entry is known valid by the time the two existing loops run, drop the redundant presence and per-family length checks from both, leaving only the nla_parse_nested() call needed to extract the data.

Affected packages

Ecosystem Package Introduced Fixed