The Linux kernel's nfsd_sock_nl_policy previously declared NFSD_A_SOCK_ADDR as a binary attribute without enforcing a minimum length, allowing a CAP_NET_ADMIN caller to send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, which triggered a 12-byte out-of-bounds read in multiple consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind). The vulnerability stemmed from duplicated and inconsistent validation logic that inadequately checked sockaddr lengths, especially for AF_INET6. The patch adds a new helper function nfsd_nl_validate_listeners() that validates the entire listener list once, ensuring each entry is correctly formed and of sufficient length for its address family before any mutation or processing occurs. This eliminates redundant and insufficient checks and prevents malformed entries from causing side effects.

A CAP_NET_ADMIN user could exploit this vulnerability to cause out-of-bounds memory reads in the kernel, potentially leading to information disclosure or kernel instability. However, exploitation requires elevated privileges (CAP_NET_ADMIN), limiting the attack surface. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly validate sockaddr lengths per address family before processing listener entries, preventing out-of-bounds reads. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.