CVE-2026-89690
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
nfsd: defer vfree of compound ops to fix rpc_status UAF
The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed
synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory.
The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory.
Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified as a use-after-free condition within the Linux kernel's NFS server implementation stems from an improper synchronization mechanism between request processing and status reporting subsystems. Specifically, the issue resides in how the rpc_status netlink dumpit function interacts with compound operation arguments during NFSv4 request handling. The dumpit routine iterates over all in-flight service requests while holding an RCU read lock to ensure structural integrity of the svc_rqst structure itself. During this iteration, for NFSv4 requests, it attempts to read operation numbers from a buffer pointed to by args->ops. However, this specific memory region is allocated via vmalloc and is subject to synchronous deallocation through vfree in nfsd4_release_compoundargs upon the completion of every compound request. While the RCU mechanism successfully protects the svc_rqst structure from being freed prematurely due to kfree_rcu usage, it fails to extend that protection to the dynamically allocated ops buffer because no corresponding deferred free mechanism was implemented for this specific allocation.
This architectural oversight creates a race condition where a concurrent completion of an NFSv4 compound operation can trigger vfree on the args->ops buffer while the dumpit function is still actively reading from it within its RCU-protected critical section. Since standard RCU read-side primitives do not automatically defer memory reclamation for vmalloc regions unless explicitly paired with appropriate deferred free calls, the pointer remains valid in terms of address space mapping but points to freed or potentially reallocated memory. The existing sequence counter check mechanism, which relies on smp_load_acquire operations against rq_status_counter, is insufficient to mitigate this specific flaw because it cannot retroactively undo a load instruction that has already fetched data from an address range that has been released back to the system allocator. Consequently, any subsequent access or interpretation of these stale pointers constitutes a classic use-after-free vulnerability, potentially leading to kernel crashes, information disclosure, or arbitrary code execution if exploited by local users with appropriate privileges to trigger NFSv4 compound operations and monitor rpc_status netlink dumps simultaneously.
From a technical classification perspective, this flaw aligns closely with CWE-416: Use After Free, as the core issue involves accessing memory after it has been made available for reuse without proper synchronization barriers ensuring data validity during concurrent access windows. In terms of adversarial tactics and techniques, this vulnerability could be leveraged within the ATT&CK framework under Tactic TA0005: Defense Evasion or TA0004: Privilege Escalation, depending on whether an attacker aims to crash the system for denial of service or exploit the memory corruption to gain elevated privileges. The specific mechanism involves manipulating timing windows between request completion and status reporting, which requires precise coordination but is feasible given that NFS operations are frequent in many enterprise environments.
The resolution implemented replaces the synchronous vfree call with kvfree_rcu_mightsleep(), a function designed specifically for deferred reclamation of vmalloc memory across RCU grace periods. By deferring the actual deallocation until after all ongoing RCU read-side critical sections have completed, the fix ensures that any concurrent reader accessing args->ops will either see valid data or be blocked by the RCU mechanism from proceeding until safety is guaranteed. This approach maintains system stability and prevents memory corruption errors while preserving the logical flow of request processing. The trade-off involves a slight increase in memory residency for completed compound operation buffers, which persist across one grace period before being reclaimed. Given that each buffer can occupy up to 200 times the size of struct nfsd4_op, this results in minimal additional overhead under normal operating conditions but provides critical protection against race-induced vulnerabilities.
To mitigate risks associated with similar synchronization issues in kernel development, it is essential to ensure that all dynamically allocated memory accessed within RCU read-side sections utilizes corresponding deferred free mechanisms such as kvfree_rcu or kfree_rcu depending on allocation type and context constraints. Developers must carefully audit code paths where multiple subsystems access shared data structures concurrently, verifying that every pointer dereference in a read-critical section is backed by an appropriate lifecycle management strategy. Regular static analysis tools focused on RCU usage patterns and dynamic testing under high-concurrency workloads can help identify these subtle timing dependencies before they manifest as exploitable vulnerabilities in production environments.