CVE-2026-89691

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear opcnt on compound arg release to prevent OOB read

nfsd4_release_compoundargs() resets args->ops to the inline iops[8]

array when the dynamically-allocated ops buffer is freed, but leaves

args->opcnt at its original value (which can be up to 200 for NFSv4.1+

compounds).

If rq_status_counter is stuck at an odd value (which can happen when

nfsd_dispatch() hits an error path after setting it odd), the RPC

status dumpit handler reads min(opcnt, 16) entries from args->ops[].

Since iops only has 8 elements and is the last field in struct

nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory

and leaks it to userspace via netlink.

Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale

compound metadata is never exposed through the status interface.

[ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References