Executive brief
The Linux kernel's NFSv4.1 network file system callback handler contains a use-after-free vulnerability in its XDR decoding logic. When processing NFS callback sequences with empty referring call lists, uninitialized pointers can be passed to memory deallocation functions, potentially allowing an attacker to crash the system or execute arbitrary code with kernel privileges.
Technical details
The vulnerability exists in fs/nfs/callback_xdr.c in the decode_cb_sequence_args() function. The function allocates memory for callback sequence arguments using kmalloc_objs(), leaving pointer members uninitialized. When decode_rc_list() encounters an empty referring call list (rcl_nrefcalls == 0), it does not initialize the rcl_refcalls pointer, leaving stale slab memory in place. Subsequently, nfs4_callback_sequence() attempts to free this uninitialized pointer, triggering a use-after-free condition. The fix changes the allocation from kmalloc_objs() to kzalloc_objs() to zero-initialize all pointer members. Attack requires network reachability to the NFS callback service and valid NFS callback protocol framing; no user authentication bypass is needed.
Affected products
- Linux Linux kernel multiple versions (introduced in 4aece6a19cf7, affecting 2.6.11 through 7.x stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90104 published
- 2026-08-20: patched: Fix committed by Trond Myklebust