CVE-2026-90104 NFSv4.1: zero referring call lists before decoding
An attacker can trigger a use-after-free in the Linux kernel NFSv4.1 callback handler by sending crafted packets, potentially causing a crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90104?
CVE-2026-90104 is a critical use after free vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: zero referring call lists before decoding
decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().
Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is NULL from the beginning, including valid empty referring call lists.
Which versions are affected by CVE-2026-90104?
How do I fix CVE-2026-90104?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90104 being exploited?
There is no known exploitation of CVE-2026-90104 in the wild and no public exploit code.
Sources
Also known as AZL-102090, BELL-CVE-2026-90104, DEBIAN-CVE-2026-90104, GHSA-8hhg-gc4j-p2q8, UBUNTU-CVE-2026-90104.