CVE-2026-89690
massUse-after-free in Linux kernel nfsd rpc_status compound-ops dump
The Linux kernel's NFS server (nfsd) frees the NFSv4 compound-operations buffer (args->ops, a vmalloc allocation of up to 200 nfsd4_op structs) synchronously via vfree() when each compound request completes, while the rpc_status netlink dump interface can still be walking that same buffer under rcu_read_lock — a lock that pins the svc_rqst struct but does not defer the vfree. A low-privileged local actor who can trigger or coincide with an rpc_status netlink dump while NFSv4 compound traffic completes races the dump against the free and reads reclaimed vmalloc memory, defeating the existing seqcount recheck. Because this is kernel memory, the practical impact is memory disclosure and plausibly privilege escalation to root or a kernel panic; CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L) with high confidentiality, integrity, and availability impact. Any Linux system running the in-kernel nfsd and serving NFSv4 — typically storage/NAS servers, HPC clusters, and hypervisors exporting NFS — is in scope, with the fix deferring the buffer free with kvfree_rcu_mightsleep(). No public PoC exists and no exploitation has been observed (not in CISA KEV).
What to do: Apply distribution kernel updates once they include the nfsd fix (the commit switching vfree(args->ops) to kvfree_rcu_mightsleep()) and reboot affected hosts. In the interim, restrict local unprivileged shell access on NFS-exporting servers, pause automated rpc_status netlink polling on busy NFSv4 servers, and disable/unload nfsd where kernel NFS service is unused. Watch for KASAN use-after-free reports or oopses in the rpc_status dump path as an indicator of attempted triggering.
| Linux kernel (nfsd) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.