CVE-2026-90104NFSv4.1: zero referring call lists before decoding
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree(). Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4aece6a19cf7f474f15eb861ba74db4479884ce3 before f4d23937e1c41995c2f54af26c89b5e48a41c299; from 4aece6a19cf7f474f15eb861ba74db4479884ce3 before f31f3c042e024aef437cda42f0424ae8d4594b6c; from 4aece6a19cf7f474f15eb861ba74db4479884ce3 before 8fa4804fe62ca4155a2d8fc2789d630376cbf2fc | CNA record |
References
- https://git.kernel.org/stable/c/f4d23937e1c41995c2f54af26c89b5e48a41c299
- https://git.kernel.org/stable/c/f31f3c042e024aef437cda42f0424ae8d4594b6c
- https://git.kernel.org/stable/c/8fa4804fe62ca4155a2d8fc2789d630376cbf2fc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.