---
id: CVE-2026-89691
title: 'nfsd: clear opcnt on compound arg release to prevent OOB read'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nfsd: clear opcnt on compound arg release to prevent OOB read

  nfsd4_release_compoundargs() resets args->ops to the inline iops[8]
  array when the dynamically-allocated …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    58bcdfb2b2e412088839ae740b1a95154dc0b8d0
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    e879148867bd4c4cac42e063ffaffa187dddc6fe
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    c1a4f7b1848f95302df598217e1c7a1410c2d0c5
  - >-
    Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c <
    ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a
  - Linux 6.7
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:04.497Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89691'
references:
  - url: 'https://git.kernel.org/stable/c/58bcdfb2b2e412088839ae740b1a95154dc0b8d0'
  - url: 'https://git.kernel.org/stable/c/e879148867bd4c4cac42e063ffaffa187dddc6fe'
  - url: 'https://git.kernel.org/stable/c/c1a4f7b1848f95302df598217e1c7a1410c2d0c5'
  - url: 'https://git.kernel.org/stable/c/ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89691.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89691'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532399'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89691'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89691'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89691.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00125
epssPercentile: 0.02199
scores:
  cna: 7.1
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear opcnt on compound arg release to prevent OOB read

nfsd4_release_compoundargs() resets args->ops to the inline iops[8]
array when the dynamically-allocated ops buffer is freed, but leaves
args->opcnt at its original value (which can be up to 200 for NFSv4.1+
compounds).

If rq_status_counter is stuck at an odd value (which can happen when
nfsd_dispatch() hits an error path after setting it odd), the RPC
status dumpit handler reads min(opcnt, 16) entries from args->ops[].
Since iops only has 8 elements and is the last field in struct
nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory
and leaks it to userspace via netlink.

Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale
compound metadata is never exposed through the status interface.

[ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]

## Affected

- `Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < 58bcdfb2b2e412088839ae740b1a95154dc0b8d0`
- `Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < e879148867bd4c4cac42e063ffaffa187dddc6fe`
- `Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < c1a4f7b1848f95302df598217e1c7a1410c2d0c5`
- `Linux >= bd9d6a3efa9709e653aafbeb859289feccb8e70c < ae4c38555e81563b8dc5eae55ffd70f0ea97aa5a`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89691.json)