UBUNTU-CVE-2026-89700: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6, causing a 12-byte OOB read across three consumers (rpccmpaddrport, svcfindlistener, kernelbind). nfsdnllistenersetdoit() also parsed and validated each listener entry inline in two separate loops, interleaved with mutating the running listener configuration. The validation was duplicated, used an open-coded "nlalen < sizeof(struct sockaddr)" check that was too short for AFINET6, and handled a malformed entry inconsistently depending on which loop noticed it. Add an nfsdnlvalidatelisteners() helper that walks the entire list once and confirms each entry parses, carries both an address and a transport name, and is long enough for its address family (sizeof(struct sockaddrin) for AFINET, sizeof(struct sockaddrin6) for AFINET6, -EAFNOSUPPORT otherwise). Call it before taking nfsdmutex or creating the serv, so a malformed request fails cleanly with no side effects. Since every entry is known valid by the time the two existing loops run, drop the redundant presence and per-family length checks from both, leaving only the nlaparsenested() call needed to extract the data.