In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read… (CVE-2026-89691)
A vulnerability in the Linux kernel's NFS server (nfsd) was resolved that could lead to an out-of-bounds read and potential information leak. The issue involved the nfsd4_release_compoundargs() function not clearing the operation count (opcnt) after freeing the dynamically allocated operations buffer, causing stale metadata to be exposed. This could result in leaking adjacent kernel memory to userspace via the netlink interface. The fix zeroes the opcnt to prevent exposure of stale compound metadata.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's NFS server (nfsd) concerns the nfsd4_release_compoundargs() function, which resets the ops pointer to a small inline array but leaves the opcnt variable unchanged. Since opcnt can be up to 200 for NFSv4.1+ compounds, and the inline ops array only has 8 elements, subsequent status dump handlers reading up to 16 entries can access out-of-bounds memory. This leads to leaking adjacent slab memory to userspace via netlink. The patch zeroes opcnt unconditionally to prevent this stale metadata exposure.
Potential Impact
This vulnerability allows an attacker with access to the NFS server status interface to read out-of-bounds kernel memory, potentially leaking sensitive information from adjacent slab memory. There is no indication of code execution or privilege escalation. The impact is limited to information disclosure via the netlink interface.
Mitigation Recommendations
A fix has been implemented that zeroes the opcnt field in nfsd4_release_compoundargs(), preventing stale compound metadata exposure. Users should apply the official Linux kernel patch that addresses this issue. No additional mitigation steps are indicated by the vendor advisory.
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read… (CVE-2026-89691)
Description
A vulnerability in the Linux kernel's NFS server (nfsd) was resolved that could lead to an out-of-bounds read and potential information leak. The issue involved the nfsd4_release_compoundargs() function not clearing the operation count (opcnt) after freeing the dynamically allocated operations buffer, causing stale metadata to be exposed. This could result in leaking adjacent kernel memory to userspace via the netlink interface. The fix zeroes the opcnt to prevent exposure of stale compound metadata.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's NFS server (nfsd) concerns the nfsd4_release_compoundargs() function, which resets the ops pointer to a small inline array but leaves the opcnt variable unchanged. Since opcnt can be up to 200 for NFSv4.1+ compounds, and the inline ops array only has 8 elements, subsequent status dump handlers reading up to 16 entries can access out-of-bounds memory. This leads to leaking adjacent slab memory to userspace via netlink. The patch zeroes opcnt unconditionally to prevent this stale metadata exposure.
Potential Impact
This vulnerability allows an attacker with access to the NFS server status interface to read out-of-bounds kernel memory, potentially leaking sensitive information from adjacent slab memory. There is no indication of code execution or privilege escalation. The impact is limited to information disclosure via the netlink interface.
Mitigation Recommendations
A fix has been implemented that zeroes the opcnt field in nfsd4_release_compoundargs(), preventing stale compound metadata exposure. Users should apply the official Linux kernel patch that addresses this issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v764-gh88-p9gg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89691"]
Threat ID: 6aa49ffc55bf5e2cf5a865e0
Added to database: 09/12/2026, 00:42:36 UTC
Last enriched: 09/12/2026, 00:51:27 UTC
Last updated: 09/12/2026, 00:52:34 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.