CVE-2026-90104 (GCVE-0-2026-90104)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
NFSv4.1: zero referring call lists before decoding
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree(). Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4aece6a19cf7f474f15eb861ba74db4479884ce3 , < f31f3c042e024aef437cda42f0424ae8d4594b6c (git)
Affected: 4aece6a19cf7f474f15eb861ba74db4479884ce3 , < 8fa4804fe62ca4155a2d8fc2789d630376cbf2fc (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f31f3c042e024aef437cda42f0424ae8d4594b6c",
              "status": "affected",
              "version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
              "versionType": "git"
            },
            {
              "lessThan": "8fa4804fe62ca4155a2d8fc2789d630376cbf2fc",
              "status": "affected",
              "version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/callback_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.1: zero referring call lists before decoding\n\ndecode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so\neach referring_call_list starts uninitialized. decode_rc_list() assigns\nrcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero\nreferring calls therefore leaves the pointer uninitialized, and\nnfs4_callback_sequence() later passes stale slab contents to kfree().\n\nAllocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is\nNULL from the beginning, including valid empty referring call lists."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - xs_read_stream_call()/rpcrdma_bc_receive_call() deliver a backchannel RPC_CALL on the established NFSv4.1 TCP or RPC/RDMA session into nfs4_callback_compound \u2192 process_op \u2192 decode_cb_sequence_args(); the attacker-controlled bytes are the CB_SEQUENCE csa_nrclists and rcl_nrefcalls XDR fields sent by the NFS server.\nAC:L - A single well-formed CB_SEQUENCE with csa_nrclists\u22651 and decode_rc_list() seeing rcl_nrefcalls==0 skips the rcl_refcalls assignment and still returns 0; nfs4_callback_sequence() then kfree()s that stale pointer. Empty referring_call_list4 is valid RFC 5661 XDR, so no race or victim-only state is required.\nPR:N - nfs_callback_authenticate() accepts RPC_AUTH_UNIX on the NFSv4.1 backchannel, and decode_cb_sequence_args() runs in process_op() before nfs4_find_client_sessionid(); the connected NFS server needs no account or capability on the client to send CB_SEQUENCE.\nUI:N - After nfs4_init_callback() has attached the backchannel (boot-time, autofs, or Kubernetes NFSv4.1 mounts), the server unilaterally sends CB_SEQUENCE; nfs4_callback_sequence() kfree()s rcl_refcalls with no further victim open, mount, or click.\nS:U - kfree of the stale rcl_refcalls pointer corrupts the NFS client\u0027s kmalloc heap in the same host kernel; it does not cross a VM, IOMMU, or guest/host boundary.\nC:H - nfs4_callback_sequence() kfree()s uninitialized rcl_refcalls left by kmalloc_objs() of csa_rclists when rcl_nrefcalls was 0. A prior CB_SEQUENCE that allocated then freed rcl_refcalls can leave that pointer in the reused slab object, a heap double-free/UAF read primitive.\nI:H - The same kfree of stale rcl_refcalls is a slab double-free of the referring_call array (size chosen by the attacker\u0027s earlier nrefcalls). Reclaim or spraying a replacement object over that free yields an arbitrary kernel write / control-flow hijack primitive.\nA:H - kfree of a non-NULL garbage rcl_refcalls pointer from a successful decode_cb_sequence_args() of an empty referring_call_list causes SLUB to BUG, oops, or panic even when the double-free is not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:03.545Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f31f3c042e024aef437cda42f0424ae8d4594b6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa4804fe62ca4155a2d8fc2789d630376cbf2fc"
        }
      ],
      "title": "NFSv4.1: zero referring call lists before decoding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90104",
    "datePublished": "2026-09-17T16:06:14.191Z",
    "dateReserved": "2026-09-11T19:38:34.786Z",
    "dateUpdated": "2026-09-18T17:53:03.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90104",
      "date": "2026-09-25",
      "epss": "0.00553",
      "percentile": "0.4385"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:28:02.000Z",
      "cve": "CVE-2026-90104",
      "id": "msrc_CVE-2026-90104",
      "initial_release_date": "2026-09-19T01:19:32.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFSv4.1: zero referring call lists before decoding",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90104.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/callback_xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f31f3c042e024aef437cda42f0424ae8d4594b6c",
                    "status": "affected",
                    "version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8fa4804fe62ca4155a2d8fc2789d630376cbf2fc",
                    "status": "affected",
                    "version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/callback_xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.31"
                  },
                  {
                    "lessThan": "2.6.31",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.1: zero referring call lists before decoding\n\ndecode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so\neach referring_call_list starts uninitialized. decode_rc_list() assigns\nrcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero\nreferring calls therefore leaves the pointer uninitialized, and\nnfs4_callback_sequence() later passes stale slab contents to kfree().\n\nAllocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is\nNULL from the beginning, including valid empty referring call lists."
          }
        ],
        "id": "CVE-2026-90104",
        "lastModified": "2026-09-18T18:17:42.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:02.217",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8fa4804fe62ca4155a2d8fc2789d630376cbf2fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f31f3c042e024aef437cda42f0424ae8d4594b6c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.