CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF
In the Linux kernel, the following vulnerability has been resolved:
nfsd: defer vfree of compound ops to fix rpcstatus UAF
The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4releasecompoundargs() at the end of every compound. The dumpit's rcureadlock pins the svcrqst struct itself (freed via kfreercu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory.
The trailing seqcount recheck (smploadacquire of rqstatuscounter) cannot undo a load that already retired against freed memory.
Fix by replacing vfree(args->ops) with kvfreercumightsleep(), which defers the free until after an RCU grace period. This makes the existing rcureadlock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 sizeof(struct nfsd4op)) persist in memory slightly longer, across one grace period, before being reclaimed.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel NFS server component with NFSv4 compound requests in flight are exposed when the rpc_status netlink dump operation can concurrently inspect request status. The affected access specifically involves NFSv4 compound-operation arguments.
What concurrency is required to trigger the use-after-free?
A compound request must complete and free its args->ops buffer while rpc_status netlink dumpit is walking in-flight service requests and reading that buffer. The dumpit’s RCU lock protects the svc_rqst structure, but before the fix it did not protect the separately vmalloc-allocated ops buffer.
How can I determine whether a kernel includes the fix?
Check whether the kernel source changes nfsd4_release_compoundargs() to replace vfree(args->ops) with kvfree_rcu_mightsleep(). The listed stable references contain the corresponding fixes.
What is the operational impact of the fix?
Completed compound-operation buffers are retained until an RCU grace period has elapsed rather than being released immediately. The description states these buffers can be up to 200 times the size of struct nfsd4_op.