CVE-2026-89690

nfsd: defer vfree of compound ops to fix rpc_status UAF

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums out of
args->ops[]. But args->ops is a separate vmalloc buffer freed
synchronously by vfree() in nfsd4_release_compoundargs() at the end
of every compound. The dumpit's rcu_read_lock pins the svc_rqst
struct itself (freed via kfree_rcu), but nothing defers the vfree
of the ops buffer across the RCU grace period. A concurrent compound
completion can therefore free the buffer while the dumpit is reading
it — a use-after-free on vmalloc memory.

The trailing seqcount recheck (smp_load_acquire of rq_status_counter)
cannot undo a load that already retired against freed memory.

Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which
defers the free until after an RCU grace period. This makes the
existing rcu_read_lock in the dumpit sufficient to protect the read.
The tradeoff is that completed compound ops buffers (up to
200 * sizeof(struct nfsd4_op)) persist in memory slightly longer,
across one grace period, before being reclaimed.

Analysis

Technical impact

The Linux kernel’s NFSv4 NFS server contains a netlink command that holds an RCU read lock and reads operation numbers from a vmalloc buffer. The buffer is freed synchronously with vfree at the end of each compound operation, but the free is not deferred across the RCU grace period. If a compound operation completes while the netlink dump is still reading the buffer, the buffer may be freed and an attacker can read from freed memory, resulting in a use‑after‑free (CWE‑825) that corrupts kernel memory.

Affected Systems

Any Linux kernel that has not implemented the commit that replaces vfree(args->ops in nfsd4_release_compoundargs is potentially affected. The advisory does not specify a version range, so all kernels lacking this commit, regardless of release, are at risk.

Risk and Exploitability

The CVSS score of 7.8 signals high severity, while the EPSS score of <1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the rpc_status netlink interface to be reachable and an NFSv4 service to be running. The or higher privilege is required; therefore the required privilege level is unknown.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 48f72aff24f7a7329209dc6cbc27c869f3e3595c
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 6703199f4d7e7f37d6a726a849eb358e8fae72fb
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 19413ccc45070a7270b9e25c2a258daf7f91de42
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< fca26a3fc19ed02278aa2a150af82d43db0302cb

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,48f72aff24f7a7329209dc6cbc27c869f3e3595c)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,6703199f4d7e7f37d6a726a849eb358e8fae72fb)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,19413ccc45070a7270b9e25c2a258daf7f91de42)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,fca26a3fc19ed02278aa2a150af82d43db0302cb)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel that contains the commit replacing vfree(args->ops with kvfree_rcu_mightsleep to eliminate the use‑after‑free flaw (CWE‑825).
Limit or remove access to the rpc_status netlink command for unprivileged users to reduce the attack surface.
If the NFSv4 compound operation feature is not needed, disable NFSv4 to eliminate the vulnerable code path.

Generated by OpenCVE AI on September 15, 2026 at 20:16 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.163% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/19413ccc45070a7270b9e25c2a258daf7f91de42
https://git.kernel.org/stable/c/48f72aff24f7a7329209dc6cbc27c869f3e3595c
https://git.kernel.org/stable/c/6703199f4d7e7f37d6a726a849eb358e8fae72fb
https://git.kernel.org/stable/c/fca26a3fc19ed02278aa2a150af82d43db0302cb
https://nvd.nist.gov/vuln/detail/CVE-2026-89690
https://www.cve.org/CVERecord?id=CVE-2026-89690

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89690 https://www.cve.org/CVERecord?id=CVE-2026-89690
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.
Title		nfsd: defer vfree of compound ops to fix rpc_status UAF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19413ccc45070a7270b9e25c2a258daf7f91de42 https://git.kernel.org/stable/c/48f72aff24f7a7329209dc6cbc27c869f3e3595c https://git.kernel.org/stable/c/6703199f4d7e7f37d6a726a849eb358e8fae72fb https://git.kernel.org/stable/c/fca26a3fc19ed02278aa2a150af82d43db0302cb