CVE-2026-90104: NFSv4.1: zero referring call lists before decoding
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: zero referring call lists before decoding
decodecbsequenceargs() allocates csarclists with kmallocobjs(), so each referringcalllist starts uninitialized. decoderclist() assigns rclrefcalls only when rclnrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4callbacksequence() later passes stale slab contents to kfree().
Allocate csarclists with kzallocobjs() so every rclrefcalls member is NULL from the beginning, including valid empty referring call lists.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The issue is reached while decoding NFSv4.1 callback sequence arguments containing a valid referring call list with zero referring calls. In that case, the list's refcalls pointer can remain uninitialized and later be passed to kfree().
Who is exposed to this vulnerability?
Systems using the Linux kernel's NFSv4.1 callback handling are exposed when they process the affected callback data. The provided information does not identify specific kernel versions or configurations.
What is the remediation?
Apply a kernel update containing the fix that changes allocation of csa_rclists from kmalloc_objs() to kzalloc_objs(). Zero-initialization ensures rcl_refcalls is NULL for empty referring call lists.