Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dump

Impact

The rpc_status netlink dumpit walks in-flight svc_rqst structures under RCU and reads NFSv4 opnums out of args->ops, but that buffer is a plain vmalloc allocation freed synchronously at the end of every compound. RCU protects the svc_rqst, not the ops buffer, so a compound completing concurrently with a status dump frees vmalloc memory that the dump is still reading. On a busy NFS server backing a GPU cluster, compounds complete constantly, so the window is open whenever anything queries rpc_status - including routine monitoring. The fix switches to kvfree_rcu_mightsleep(), at the cost of holding completed ops buffers for one grace period.

Who can reach it

Local. A user able to issue the nfsd rpc_status netlink dump (root or a process with the matching capability in the namespace) racing against normal NFSv4 client traffic on the same server.

What to do

Update to a stable kernel containing commit 19413ccc4507 or its backport and reboot the NFS server nodes. Until then, avoid running nfsd rpc_status queries (including monitoring agents that poll it) on affected kernels.

References

Related entries

• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memoryCVE-2026-89760 · Linux kernel mm/swap (hibernation slot freed while in the swap cache)High
• Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn downCVE-2026-89763 · Linux kernel KEYS trusted-key TPM backend (module teardown ordering)High
• Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local rootCVE-2026-89791 · Linux kernel perf subsystem (perf_mmap_close / ring-buffer revival race)High