Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dump

Impact

The rpc_status netlink dumpit walks in-flight svc_rqst structures under RCU and reads NFSv4 opnums out of args->ops, but that buffer is a plain vmalloc allocation freed synchronously at the end of every compound. RCU protects the svc_rqst, not the ops buffer, so a compound completing concurrently with a status dump frees vmalloc memory that the dump is still reading. On a busy NFS server backing a GPU cluster, compounds complete constantly, so the window is open whenever anything queries rpc_status - including routine monitoring. The fix switches to kvfree_rcu_mightsleep(), at the cost of holding completed ops buffers for one grace period.

Who can reach it

Local. A user able to issue the nfsd rpc_status netlink dump (root or a process with the matching capability in the namespace) racing against normal NFSv4 client traffic on the same server.

What to do

Update to a stable kernel containing commit 19413ccc4507 or its backport and reboot the NFS server nodes. Until then, avoid running nfsd rpc_status queries (including monitoring agents that poll it) on affected kernels.

References

Related entries

• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High