UBUNTU-CVE-2026-89690: Use After Free

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4releasecompoundargs() at the end of every compound. The dumpit's rcureadlock pins the svcrqst struct itself (freed via kfreercu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smploadacquire of rqstatuscounter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfreercumightsleep(), which defers the free until after an RCU grace period. This makes the existing rcureadlock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 sizeof(struct nfsd4op)) persist in memory slightly longer, across one grace period, before being reclaimed.