CVE-2026-90104 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: zero referring call lists before decoding
decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().
Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel involves a critical memory initialization flaw within the NFSv4.1 callback sequence handling mechanism. Specifically, the function decode_cb_sequence_args allocates structures for referring_call_lists using kmalloc_objs without zeroing out the allocated memory. This allocation strategy leaves the internal pointers uninitialized when no actual referring calls are present in the incoming data stream. The subsequent decoding logic correctly assigns references only if a non-zero count of referring calls is detected, but it fails to initialize the pointer field when that count is zero. Consequently, for valid NFSv4.1 sequences containing an empty list of referring calls, the rcl_refcalls member retains whatever garbage values were previously present in that slab cache location rather than being set to NULL.
This uninitialized memory state leads directly to a use-after-free or invalid free scenario during subsequent cleanup operations. When nfs4_callback_sequence completes its processing and attempts to release resources, it invokes kfree on the rcl_refcalls pointer without verifying whether it was properly initialized. Because the pointer contains stale data from previously freed objects in the slab allocator, this operation results in passing arbitrary memory addresses to the kernel's free routine. Such behavior can trigger a kernel panic due to invalid memory access or potentially allow an attacker with network-level access to manipulate control flow by crafting malicious NFSv4.1 packets that exploit these uninitialized pointers for code execution privileges within the kernel space.
From a technical classification perspective, this vulnerability aligns closely with CWE-908 which denotes use of uninitialized resource and CWE-416 concerning use after free conditions. The root cause stems from insufficient initialization of memory structures before they are utilized in critical path operations involving dynamic memory management. In terms of the MITRE ATT&CK framework, this flaw could be leveraged as part of an exploitation chain under techniques related to privilege escalation or denial of service through kernel crashes. Attackers targeting NFS services would need to send specifically crafted CB_SEQUENCE requests with zero referring calls to trigger the uninitialized pointer path and subsequently cause system instability or gain unauthorized access depending on how the stale memory contents are interpreted by kfree.
The resolution implemented in this patch addresses the issue at its source by replacing kmalloc_objs with kzalloc_objs during the allocation of csa_rclists structures. This change ensures that every member within the referring_call_list, including rcl_refcalls, is explicitly set to NULL upon allocation regardless of whether any actual references exist in the decoded data. By guaranteeing proper initialization even for empty lists, the kernel prevents stale pointer values from persisting into subsequent processing stages where they might be erroneously dereferenced or freed. This fix eliminates the possibility of passing invalid addresses to memory deallocation routines and restores safe operation boundaries within the NFSv4.1 callback handling subsystem.
System administrators should apply this patch immediately if their systems run vulnerable versions of the Linux kernel with NFS server components enabled. Mitigation strategies also include restricting network access to NFS services where possible, implementing strict input validation at firewall levels to reject malformed CB_SEQUENCE requests, and monitoring for unusual kernel log messages indicating memory corruption or panic events related to slab allocator operations. Regular updates to the kernel ensure that such low-level initialization flaws are corrected before they can be exploited in production environments relying on network file sharing protocols.