CVE-2026-89700

In the Linux kernel, the following vulnerability has been resolved:

nfsd: validate sockaddr length per family in listener set

nfsd sock nl policy declares NFSD A SOCK ADDR as a bare NLA BINARY attribute with no minimum length. A CAP NET ADMIN caller can send a 16-byte NFSD A SOCK ADDR with sa family=AF INET6, causing a 12-byte OOB read across three consumers (rpc cmp addr port, svc find listener, kernel bind).

nfsd nl listener set doit() also parsed and validated each listener entry inline in two separate loops, interleaved with mutating the running listener configuration. The validation was duplicated, used an open-coded "nla len < sizeof(struct sockaddr)" check that was too short for AF INET6, and handled a malformed entry inconsistently depending on which loop noticed it.

Add an nfsd nl validate listeners() helper that walks the entire list once and confirms each entry parses, carries both an address and a transport name, and is long enough for its address family (sizeof(struct sockaddr in) for AF INET, sizeof(struct sockaddr in6) for AF INET6, -EAFNOSUPPORT otherwise). Call it before taking nfsd mutex or creating the serv, so a malformed request fails cleanly with no side effects.

Since every entry is known valid by the time the two existing loops run, drop the redundant presence and per-family length checks from both, leaving only the nla parse nested() call needed to extract the data.