Cloudanix VulnDB

CVE-2026-89690

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file sharing code could let nearby users peek at or damage internal memory, risking system takeover or crashes on affected servers.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free on vmalloc memory allowing concurrent reads from a freed args->ops buffer in the rpc_status netlink dumpit handler while nfsd4_release_compoundargs performs vfree during NFSv4 compound completion.

Why it matters to the business

Local attackers on Red Hat Enterprise Linux systems running NFS servers can read kernel memory or trigger crashes, enabling privilege escalation or denial of service that disrupts file sharing services.

How an attack unfolds

An attacker with local access triggers NFSv4 compound requests while simultaneously using the rpc_status netlink interface to walk in-flight svc_rqst structures under rcu_read_lock, racing the synchronous vfree of the ops buffer against the dumpit's read of opnums.

How to fix it

Upgrade affected kernels to the fixed versions: kernel (redhat el10) 6.12.0-211.64.1.el10_2 or kernel (redhat el9) 5.14.0-687.56.1.el9_8 via the referenced RHSA-2026:77689.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the listed fixed packages; exercise nfsd4 compound paths while monitoring the rpc_status netlink dump under load to verify absence of UAF warnings.

Typical attack path

  1. Gain local unprivileged access on an affected Red Hat system
  2. Issue NFSv4 compound operations against a locally mounted or served export
  3. Open and issue netlink dump requests on the rpc_status socket concurrently
  4. Trigger the race to read from the freed vmalloc buffer

How to detect it

Inspect kernel logs for use-after-free warnings involving nfsd, compoundargs, or rpc_status; correlate netlink activity on rpc sockets with nfsd4 request completion patterns.

What your security team should do

  • Apply the kernel updates from RHSA-2026:77689 as soon as possible
  • Restrict local access and netlink privileges on systems exposing NFSv4
  • Enable kernel hardening features such as CONFIG_KASAN and hardened allocators where feasible
  • Monitor kernel logs for nfsd and vmalloc related warnings

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.

Affected packages

Ecosystem Package Introduced Fixed