CVE-2026-89691

nfsd: clear opcnt on compound arg release to prevent OOB read

Published Sep 11, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear opcnt on compound arg release to prevent OOB read

nfsd4_release_compoundargs() resets args->ops to the inline iops[8]
array when the dynamically-allocated ops buffer is freed, but leaves
args->opcnt at its original value (which can be up to 200 for NFSv4.1+
compounds).

If rq_status_counter is stuck at an odd value (which can happen when
nfsd_dispatch() hits an error path after setting it odd), the RPC
status dumpit handler reads min(opcnt, 16) entries from args->ops[].
Since iops only has 8 elements and is the last field in struct
nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory
and leaks it to userspace via netlink.

Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale
compound metadata is never exposed through the status interface.

[ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]

Analysis

Technical impact

In the Linux kernel, the NFS server fails to reset the operand count when releasing compound arguments. If the RPC status counter becomes stuck at an odd value, the status dump handler reads entries beyond the valid array, leaking adjacent slab-bounds read exposes confidential kernel data to userspace. The flaw could result in the unauthorized retrieval of kernel memory contents, potentially revealing sensitive information such as cryptographic keys or configuration data.

Affected Systems

The affected product is the Linux kernel. No specific kernel versions are enumerated in the advisory; the fix is included in commits referenced in the source URLs and applies to all kernel releases containing the nfsd4_release_compoundargs function.

Risk and Exploitability

The CVSS score of 7.1 indicates a High severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. Consequently, the exploitation likelihood is low, but because the vulnerability requires an error path to be hit and the exposure is via netlink, the overall risk is moderate. The recommended mitigation is to apply a kernel update that includes the opcnt reset change.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< 58bcdfb2b2e412088839ae740b1a95154dc0b8d0
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< e879148867bd4c4cac42e063ffaffa187dddc6fe
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< c1a4f7b1848f95302df598217e1c7a1410c2d0c5
`bd9d6a3efa9709e653aafbeb859289feccb8e70c`	affected	< ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,58bcdfb2b2e412088839ae740b1a95154dc0b8d0)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,e879148867bd4c4cac42e063ffaffa187dddc6fe)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,c1a4f7b1848f95302df598217e1c7a1410c2d0c5)`	affected	code_commit	—
`[bd9d6a3efa9709e653aafbeb859289feccb8e70c,ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel release that contains the nfsd4_release_compoundargs fix (e.g., kernel commits after 58)
If an immediate kernel upgrade is not feasible, disable the RPC status dump interface or configure the NFS server to reject compound requests that may trigger the bug, eliminating the leakage path
Deploy monitoring for anomalous netlink traffic that could indicate memory extraction attempts

Generated by OpenCVE AI on September 15, 2026 at 20:16 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.125% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/58bcdfb2b2e412088839ae740b1a95154dc0b8d0
https://git.kernel.org/stable/c/ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a
https://git.kernel.org/stable/c/c1a4f7b1848f95302df598217e1c7a1410c2d0c5
https://git.kernel.org/stable/c/e879148867bd4c4cac42e063ffaffa187dddc6fe
https://nvd.nist.gov/vuln/detail/CVE-2026-89691
https://www.cve.org/CVERecord?id=CVE-2026-89691

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Sep 12, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89691 https://www.cve.org/CVERecord?id=CVE-2026-89691
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H'}` threat_severity `Important`

Sep 12, 2026 8:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_release_compoundargs() resets args->ops to the inline iops[8] array when the dynamically-allocated ops buffer is freed, but leaves args->opcnt at its original value (which can be up to 200 for NFSv4.1+ compounds). If rq_status_counter is stuck at an odd value (which can happen when nfsd_dispatch() hits an error path after setting it odd), the RPC status dumpit handler reads min(opcnt, 16) entries from args->ops[]. Since iops only has 8 elements and is the last field in struct nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory and leaks it to userspace via netlink. Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale compound metadata is never exposed through the status interface. [ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]
Title		nfsd: clear opcnt on compound arg release to prevent OOB read
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/58bcdfb2b2e412088839ae740b1a95154dc0b8d0 https://git.kernel.org/stable/c/ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a https://git.kernel.org/stable/c/c1a4f7b1848f95302df598217e1c7a1410c2d0c5 https://git.kernel.org/stable/c/e879148867bd4c4cac42e063ffaffa187dddc6fe