EUVD-2026-76603
GHSA-v764-gh88-p9gg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local low-privilege access required; AC:H because rq_status_counter error-path precondition is non-trivial; A:L not A:H since primary impact is heap disclosure not crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: clear opcnt on compound arg release to prevent OOB read
nfsd4_release_compoundargs() resets args->ops to the inline iops[8] array when the dynamically-allocated ops buffer is freed, but leaves args->opcnt at its original value (which can be up to 200 for NFSv4.1+ compounds).
If rq_status_counter is stuck at an odd value (which can happen when nfsd_dispatch() hits an error path after setting it odd), the RPC status dumpit handler reads min(opcnt, 16) entries from args->ops[]. Since iops only has 8 elements and is the last field in struct nfsd4_compoundargs, reading indices 8-15 accesses adjacent slab memory and leaks it to userspace via netlink.
Zero opcnt unconditionally in nfsd4_release_compoundargs() so stale compound metadata is never exposed through the status interface.
[ cel: Remove the kvfree_rcu_mightsleep() sleep from the exposure window ]
AnalysisAI
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) Linux NFS server (nfsd) must be active and serving NFSv4.1+ clients; (2) the attacker must have local, low-privileged access to the NFS server host and ability to open netlink sockets to the RPC status interface; (3) rq_status_counter must be at an odd value, which occurs when nfsd_dispatch() hits an error path - this is not a persistent default state, so an attacker may need to induce the error condition or wait for it; (4) kernel version must be between the introduction commit (bd9d6a3efa97, around Linux 6.7) and the applicable fix commit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) has two noteworthy tensions: AC:L appears optimistic given that exploitation requires rq_status_counter to be stuck at an odd value via an error path in nfsd_dispatch - a non-trivial precondition that realistically raises complexity to AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 containing commits 58bcdfb2b2e4, e879148867bd, c1a4f7b1848f, or ae4c38555e81 respectively (see https://git.kernel.org/stable/c/58bcdfb2b2e412088839ae740b1a95154dc0b8d0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Linux-based NFS servers in your environment and document their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today