CVE-2026-89690
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel's nfsd module, the args->ops buffer is freed synchronously via vfree() in nfsd4_release_compoundargs(), while the rpc_status netlink dumpit handler reads that buffer under rcu_read_lock. A concurrent compound completion can free the buffer while it is being read, causing a use-after-free on vmalloc memory. The fix replaces vfree() with kvfree_rcu_mightsleep(), deferring the free across an RCU grace period.
Risk Assessment
A local attacker with access to the rpc_status netlink interface can trigger a use-after-free in the kernel, potentially leading to privilege escalation or system crash. The risk is high due to the possibility of kernel-context code execution.
Recommendation
Update the Linux kernel to a version containing the fix that replaces vfree() with kvfree_rcu_mightsleep(). Restrict access to the rpc_status netlink interface to trusted processes.
Other vulnerabilities in Linux kernel (nfsd)
See all- CVE-2026-89703Critical
In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().
- CVE-2026-89697Critical
In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.
- CVE-2026-89689Critical
A use-after-free vulnerability was found in the Linux kernel nfsd module within nfsd4_sequence(). When the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs, free_session_slots() may free the slot currently being processed because it does not check seq->slotid or the NFSD4_SLOT_INUSE flag. This leads to memory corruption via writes into the freed sl_data[] buffer.
- CVE-2026-89688Critical
In the Linux kernel's nfsd module, nfs4_preprocess_seqid_op() on an -EAGAIN error from nfsd4_cstate_assign_replay() dropped a stateowner reference it never acquired, while leaking the stid reference. This risks a stateowner refcount underflow and use-after-free, and can stall a concurrent nfsd4_close_open_stateid(). The fix drops the stid reference before retrying.
- CVE-2026-89686Critical
In the Linux kernel, nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering BUG_ON. The race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall.
- CVE-2026-89681Critical
In the Linux kernel, the workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.
- CVE-2022-43945High
The NFSD implementation in the Linux kernel prior to versions 5.19.17 and 6.0.2 is vulnerable to buffer overflow. A client can force the send buffer to shrink by sending an RPC message with garbage data, leading to writes beyond the allocated buffer space.
- CVE-2026-90236Low risk· EPSS 11%
A bug was found in the Linux kernel NFSD (NFS server) module where the export reference (svc_export) was leaked when reaping open and lock stateids. The free_ol_stateid_reaplist() function freed stateids directly via ->sc_free(), bypassing the nfs4_put_stid() path that releases the export reference. As a result, the reference was never dropped, pinning the export and blocking unmount for the lifetime of the stateid.
- CVE-2026-89706High
In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.
- CVE-2026-89705High
In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS