CVE-2026-89690

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under

rcu_read_lock and, for NFSv4 requests, reads opnums out of

args->ops[]. But args->ops is a separate vmalloc buffer freed

synchronously by vfree() in nfsd4_release_compoundargs() at the end

of every compound. The dumpit's rcu_read_lock pins the svc_rqst

struct itself (freed via kfree_rcu), but nothing defers the vfree

of the ops buffer across the RCU grace period. A concurrent compound

completion can therefore free the buffer while the dumpit is reading

it — a use-after-free on vmalloc memory.

The trailing seqcount recheck (smp_load_acquire of rq_status_counter)

cannot undo a load that already retired against freed memory.

Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which

defers the free until after an RCU grace period. This makes the

existing rcu_read_lock in the dumpit suff

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References