CVE-2026-89691

A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. The nfsd4_release_compoundargs() function does not properly clear an internal counter (opcnt) when releasing a buffer. This oversight can lead to an out-of-bounds read, allowing an attacker to access adjacent memory and potentially leak sensitive information to userspace through netlink.

An out-of-bounds read in the NFSD rpc_status reporting path can expose adjacent slab memory because nfsd4_release_compoundargs resets args ops to the inline iops array but leaves args opcnt stale. A remote NFS client can influence compound metadata and error paths, while a local user that can query the RPC status netlink interface may receive leaked kernel memory when the status counter remains in the in progress state. For the CVSS the PR:L is used for the paranoid score because practical data retrieval requires a local process or service account with access to the netlink status interface, even though stale metadata can be influenced by NFS traffic. The issue is network adjacent for the trigger and local for the leak sink. Impact is primarily confidentiality loss from kernel memory disclosure, with no direct write primitive or kernel crash shown by the patch context. NFS servers are typically deployed inside trusted internal or data-center networks rather than exposed to the public Internet.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.