CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc status UAF

The rpc status netlink dumpit walks every in-flight svc rqst under rcu read lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4 release compoundargs() at the end of every compound. The dumpit's rcu read lock pins the svc rqst struct itself (freed via kfree rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory.

The trailing seqcount recheck (smp load acquire of rq status counter) cannot undo a load that already retired against freed memory.

Fix by replacing vfree(args->ops) with kvfree rcu mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu read lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4 op)) persist in memory slightly longer, across one grace period, before being reclaimed.