CVE-2026-90104

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFSv4.1 implementation where the decode cb sequence args() function allocates csa rclists using kmalloc objs(), leaving each referring call list uninitialized. Because decode rc list() only assigns rcl refcalls when rcl nrefcalls is nonzero, a valid list with zero referring calls results in an uninitialized pointer. Consequently, nfs4 callback sequence() may pass stale slab contents to kfree(), which can lead to memory corruption or system instability.

Recommendations Update the Linux kernel to a version where csa rclists is allocated with kzalloc objs() to ensure all rcl refcalls members are initialized to NULL.