ZeroDay Findings
Sign inSign up

Findings

CVE-2026-90104

NFSv4.1: zero referring call lists before decoding

Published Sep 17, 2026 · updated Oct 15, 2026

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree(). Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 17, 2026 · OSV.dev

    Detected

    In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and n

  2. Oct 14, 2026 · OSV.dev

    Fix available

    Kernel fixed in 7.2.6

  3. Oct 14, 2026 · OSV.dev

    Fix available

    Kernel fixed in 7.2.6

  4. Oct 14, 2026 · OSV.dev

    Updated

    In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and n

  5. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and n

Affected

  • Linux Kernel2.6.31 → 7.2.6

Sources

  • CVE.orgCVE-2026-90104

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-90104

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDCVE-2026-90104

    In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls on

    nvd.nist.gov
  • OSV.devCVE-2026-90104

    NFSv4.1: zero referring call lists before decoding

    osv.dev

References