CVE-2026-90104 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining systems that use NFSv4.1 should assess exposure and apply the patch. This includes operators managing Linux-based infrastructure, platform administrators overseeing system updates, vulnerability management teams evaluating risk, and security teams monitoring for potential exploitation attempts.

Why it matters

CVE-2026-90104 is a critical vulnerability in the Linux kernel's NFSv4.1 implementation that could allow remote attackers to execute arbitrary code or cause a denial-of-service (DoS). Linux kernel developers and administrators should assess exposure and apply the patch.

• Remote code execution is possible if an attacker can send a specially crafted NFSv4.1 request.
• Denial-of-service (DoS) may occur if an attacker can cause the nfs4_callback_sequence() function to pass stale slab contents to kfree().
• Verification of kernel patch application is necessary to ensure vulnerability remediation.
• Exposure assessment and inventory checks are required to identify potentially affected systems.

Technical summary

The Linux kernel's NFSv4.1 implementation has a vulnerability in the decode_cb_sequence_args() function. The function allocates csa_rclists with kmalloc_objs(), which does not initialize the referring call lists. This can cause the nfs4_callback_sequence() function to pass stale slab contents to kfree(), potentially leading to a denial-of-service (DoS) or code execution. The vulnerability was resolved by allocating csa_rclists with kzalloc_objs() instead of kmalloc_objs(). This ensures that every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists. Affected Linux kernel developers and administrators should assess exposure and apply the patch.

Defensive priority

High

Recommended defensive actions

• Review and apply the kernel patch to ensure csa_rclists are properly initialized.
• Monitor NFSv4.1 traffic for potential exploitation attempts.
• Verify that affected systems are running the patched kernel version.
• Perform vulnerability assessment to identify potentially affected systems.
• Review system logs for signs of exploitation.
• Implement compensating controls for exposed systems.
• Track patch application and verification progress.

Evidence notes

The vulnerability was resolved by allocating csa_rclists with kzalloc_objs() instead of kmalloc_objs(). This ensures that every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.