HIGH Introduced in 6.7
nfsd CompoundArgs OOB
CVE-2026-89691
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI2.5LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_release_compoundargs() resets args->ops to the inline iops[8] array when the dynamically-allocated ops buffer is freed, but leaves args->opcnt at its original value (which can be up to 200 for NFSv4.1+ compounds). If rq_status_counter is stuck at an odd value (which can happen when nfsd_dispatch() hits an error path after setting it odd), the RPC status dumpit handler reads min(opcnt, 16) entries from args->ops[]. Since iops only has 8 elements and is the last field in struct nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory and leaks it to userspace via netlink. Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale compound metadata is never exposed through the status interface. [ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]
02KernelScan AI Analysis
Risk summary
A local attacker who can query the NFSD RPC-status netlink interface can read a bounded amount of adjacent kernel slab memory when a prior NFSv4 compound request left stale operation-count metadata behind. The disclosure requires the NFS server to be running and an error path in the dispatch routine to have left the status counter in a stuck state. Impact is limited to information leakage with no integrity or availability effect.
Vulnerability analysis
When the NFS server finishes processing an NFSv4 compound request whose operation count exceeded the inline array size, the cleanup routine resets the operations pointer back to the small inline array but leaves the operation count at its original large value. If the RPC status counter is left in a stuck state after a dispatch error, the netlink RPC-status dump handler reads up to 16 entries from that inline array, which only holds 8, causing entries 8 through 15 to be read from adjacent kernel slab memory and exposed to userspace. The fix unconditionally zeroes the operation count during compound argument release so no stale metadata can be surfaced through the status interface. This path requires the NFS server to be active and processing NFSv4 compounds, and the leaked data is only accessible by a local user who can query the RPC-status netlink interface.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.7 | 6.12.109 | 58bcdfb2b2e4 |
| mainline | 6.7 | 7.3-rc1 | ae4c38555e81 |
| 7.2 | 6.7 | 7.2.4 | c1a4f7b1848f |
| 6.18 | 6.7 | 6.18.50 | e879148867bd |
| cip/6.12 | 6.7 | 6.12.111-cip32 | 58bcdfb2b2e4 |