Linux kernel nfsd: stale opcnt after compound release leaks adjacent slab memory through the RPC status netlink dump

Impact

nfsd4_release_compoundargs() resets args->ops to the inline 8-element iops[] array but leaves args->opcnt at its original value, which can be up to 200 for NFSv4.1+ compounds. If rq_status_counter is left odd, the RPC status dumpit handler reads min(opcnt, 16) entries, so indices 8 through 15 read adjacent slab memory past the end of the structure and hand it to userspace over netlink. That is a kernel heap disclosure to whoever can query the nfsd status interface on the storage server - useful for defeating KASLR or lifting neighbouring kernel data. Local only: it requires a process on the NFS server itself, not a remote client, which limits it to operators and anything running on the storage head.

Who can reach it

A local user or process on the NFS server able to issue the nfsd RPC-status netlink dump. Not reachable from remote NFS clients.

What to do

Update the server kernel to a build that zeroes opcnt on compound release (stable commits 58bcdfb2b2e4, ae4c38555e81, c1a4f7b1848f, e879148867bd) and reboot the node. In the meantime, keep unprivileged workloads off the NFS server itself - a dedicated storage head with no tenant processes is not meaningfully exposed.

References

Related entries

• Linux kernel nfsd: dispatch error paths leave the status seqlock counter odd, exposing mutating compound stateCVE-2026-89705 · Linux kernel nfsd (nfsd_dispatch rq_status_counter seqlock protocol)High
• Flux CD (allow-webhooks NetworkPolicy, notification-controller event server): CROSS-TENANT EVENT FORGERY: theNCVD-2026-057-flux-cd-allow-webhooks-networkpo · Flux CD (allow-webhooks NetworkPolicy, notification-controller event server)High
• OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bitCVE-2023-51767 · OpenSSH through 10.0 - mm_answer_authpassword uses an integer 'authenticated' flag that does not resist a single bit…High
• AMD Radeon RGB tool - signature verification on files in the installation directory: The Radeon RGB tool doesCVE-2024-36334 · AMD Radeon RGB tool - signature verification on files in the installation directoryHigh
• Intel Neural Compressor (SQL injection, second instance): A second SQL-injection path in Neural Compressor reachableCVE-2024-39766 · Intel Neural Compressor (SQL injection, second instance)High
• Redis: Authenticated user triggers a stack/heap out-of-bounds write in hyperloglog opsCVE-2025-32023 · RedisHigh