TI-2026-60733 Aliases CVE-2026-89690 GHSA-vprx-6mqf-hg7q

nfsd: defer vfree of compound ops to fix rpc_status UAF

LOW 33Published 2026-09-11 · Updated 2026-10-19

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 13 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound. The dumpit's rcu_read_lock pins the svc_rqst struct itself (freed via kfree_rcu), but nothing defers the vfree of the ops buffer across the RCU grace period. A concurrent compound completion can therefore free the buffer while the dumpit is reading it — a use-after-free on vmalloc memory. The trailing seqcount recheck (smp_load_acquire of rq_status_counter) cannot undo a load that already retired against freed memory. Fix by replacing vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period. This makes the existing rcu_read_lock in the dumpit sufficient to protect the read. The tradeoff is that completed compound ops buffers (up to 200 * sizeof(struct nfsd4_op)) persist in memory slightly longer, across one grace period, before being reclaimed.

Why it matters now

EPSS 0.00163 5th percentileScored 2026-11-07

Fix Partial Linux (Linux): 6.12.109, 6.18.50, 7.2.4 +1Red Hat: 3 advisoriesRed Hat: 13 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	Linux	6.7 and later	6.12.109, 6.18.50, 7.2.4, 7.3	Patch available	CNA

Linux VendorLinux Affected 6.7 and later Fixed in 6.12.109, 6.18.50, 7.2.4, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	—	—	Linux

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Fix · CNA Linux (Linux) Fixed in 6.12.109, 6.18.50, 7.2.4, 7.3

Red Hat 3 advisories

RHSA-2026:89197 Released 2026-10-27 · Red Hat rating Critical
OpenShift Container Platform 4.22.20 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202610241758-0, rhcos-ppc64le-4.22.9.8.202610241758-0, rhcos-s390x-4.22.9.8.202610241758-0 +1
RHSA-2026:77689 Released 2026-10-08 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.56.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.56.1.el9_8, kernel-64k-devel-5.14.0-687.56.1.el9_8 +12
- Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.56.1.el9_8, kernel-64k-5.14.0-687.56.1.el9_8, kernel-64k-core-5.14.0-687.56.1.el9_8 +28
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.56.1.el9_8, libperf-5.14.0-687.56.1.el9_8
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.56.1.el9_8, kernel-rt-64k-5.14.0-687.56.1.el9_8, kernel-rt-64k-core-5.14.0-687.56.1.el9_8 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.56.1.el9_8, kernel-rt-core-5.14.0-687.56.1.el9_8, kernel-rt-debug-5.14.0-687.56.1.el9_8 +9
RHSA-2026:77690 Released 2026-10-08 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- 10Base-SMTV kernel-modules-internal-6.12.0-211.64.1.el10_2
- Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.64.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.64.1.el10_2, kernel-64k-devel-6.12.0-211.64.1.el10_2 +12
- Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.64.1.el10_2, kernel-64k-6.12.0-211.64.1.el10_2, kernel-64k-core-6.12.0-211.64.1.el10_2 +29
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.64.1.el10_2, libperf-6.12.0-211.64.1.el10_2
- Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal-6.12.0-211.64.1.el10_2
- Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.64.1.el10_2, kernel-rt-64k-6.12.0-211.64.1.el10_2, kernel-rt-64k-core-6.12.0-211.64.1.el10_2 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.64.1.el10_2, kernel-rt-core-6.12.0-211.64.1.el10_2, kernel-rt-debug-6.12.0-211.64.1.el10_2 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	—
Red Hat OpenShift Container Platform 5	Affected	No fix yet
10Base-SMTV	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:77689
Red Hat Enterprise Linux BaseOS (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2026:77689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)	Fixed	RHSA-2026:77689
Red Hat Enterprise Linux Hidden (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux Real Time (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux Real Time (v. 9)	Fixed	RHSA-2026:77689
Red Hat Enterprise Linux Real Time for NFV (v. 10)	Fixed	RHSA-2026:77690
Red Hat Enterprise Linux Real Time for NFV (v. 9)	Fixed	RHSA-2026:77689
Red Hat OpenShift Container Platform 4.22	Fixed	RHSA-2026:89197

Not affected: 4 products

Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2026-89690
2026-10-03 Alias added: GHSA-vprx-6mqf-hg7q
2026-10-09 Fix available: RHSA-2026:77689 · Red Hat
2026-10-09 Fix available: RHSA-2026:77690 · Red Hat
2026-10-09 Fix available: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) +9 · Red Hat
2026-10-19 Fix available: Linux/[email protected] · CNA
2026-10-28 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat
2026-10-29 Fix available: RHSA-2026:89197 · Red Hat
2026-10-29 Affected versions changed · Red Hat
2026-10-30 Affected versions changed · Red Hat

References

Other 4

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4

See all 21727 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences