CVE-2026-89691

The Linux kernel's NFS server (nfsd) fails to reset the compound operation count when releasing NFSv4.1+ compound arguments: nfsd4_release_compoundargs() points args->ops back at the 8-element inline iops array after freeing the dynamically allocated operations buffer, but leaves args->opcnt at its original value (up to 200). If nfsd_dispatch() has hit an error path that leaves the per-request status counter stuck at an odd value, the RPC status dump handler reads up to 16 entries from that array, so indices 8-15 read past the end of struct nfsd4_compoundargs into adjacent slab memory, which is then leaked to userspace over netlink. A local attacker with low privileges on a host running nfsd can leverage this to disclose kernel memory (CVSS 3.1: 7.1, high, with high confidentiality and availability impact). Affected systems are Linux hosts running the kernel NFS server that serve NFSv4.1+ compounds with more than 8 operations, such as enterprise file servers, HPC clusters, and shared storage nodes. No public proof of concept or in-the-wild exploitation is known; the fix zeroes opcnt unconditionally during compound-arg release and also removes a might-sleep call from the exposure window.

What to do: Apply a kernel update containing the fix (nfsd4_release_compoundargs() now zeroes opcnt unconditionally) as soon as your distribution ships it. In the interim, minimize unprivileged local accounts on NFS servers and restrict access to netlink/procfs RPC status interfaces where feasible. Confirm whether nfsd is running and serving NFSv4.1+ (e.g., 'systemctl status nfs-server' or checking /proc/fs/nfsd/versions), prioritizing shared HPC and login nodes with many local users.