CVE-2026-90104

NFSv4.1: zero referring call lists before decoding

State: Published
Severity: 9.8 Critical
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: zero referring call lists before decoding

decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().

Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 810f6b3a29ac96fdc16909132b31627dae6824c2Affected 4aece6a19cf7f474f15eb861ba74db4479884ce3 to before ed54460caf5b5aa65ec03c9a6032d831f39f19f5Affected 4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 7510a5b9edec9d9536a4e69f10edfb2592e6cf7fAffected 4aece6a19cf7f474f15eb861ba74db4479884ce3 to before f4d23937e1c41995c2f54af26c89b5e48a41c299Affected 4aece6a19cf7f474f15eb861ba74db4479884ce3 to before f31f3c042e024aef437cda42f0424ae8d4594b6cAffected 4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 8fa4804fe62ca4155a2d8fc2789d630376cbf2fcAffected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 810f6b3a29ac96fdc16909132b31627dae6824c2Affected
4aece6a19cf7f474f15eb861ba74db4479884ce3 to before ed54460caf5b5aa65ec03c9a6032d831f39f19f5Affected
4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 7510a5b9edec9d9536a4e69f10edfb2592e6cf7fAffected
4aece6a19cf7f474f15eb861ba74db4479884ce3 to before f4d23937e1c41995c2f54af26c89b5e48a41c299Affected
4aece6a19cf7f474f15eb861ba74db4479884ce3 to before f31f3c042e024aef437cda42f0424ae8d4594b6cAffected
4aece6a19cf7f474f15eb861ba74db4479884ce3 to before 8fa4804fe62ca4155a2d8fc2789d630376cbf2fcAffected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.