Linux Kernel EUVD-2026-81697

The affected host must be acting as an NFSv4.1 client (which runs a kernel callback service), and the trigger must arrive from the NFS server side - so exploitation requires the attacker to operate a malicious NFSv4.1 server, or MITM/compromise a server the victim already mounts from. The specific trigger is a syntactically valid CB_SEQUENCE callback whose referring_call_list has rcl_nrefcalls == 0, leaving rcl_refcalls uninitialized before kfree(). Outcome depends on nondeterministic slab contents at that address, so reliable exploitation (beyond a crash) is not guaranteed. Not reachable on hosts that do not use NFSv4.1 as a client or that only connect to trusted servers.

The vendor-assigned CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the Linux kernel CNA's routine auto-maximum and overstates real-world risk for this bug. The actual defect is a memory-safety flaw on the NFSv4.1 client: decode_cb_sequence_args() allocates csa_rclists with kmalloc (uninitialized), so a valid CB_SEQUENCE carrying a referring_call_list with zero referring calls leaves rcl_refcalls holding stale slab contents, which nfs4_callback_sequence() later passes to kfree(). This is an invalid/uninitialized-pointer free whose realistic outcome is a kernel crash/oops (DoS) with only theoretical potential for corruption if the garbage happens to be an attacker-influenceable pointer - it is NOT a confident path to confidentiality or integrity loss, so C:H/I:H are not supported. No EPSS score, no CISA KEV listing, and no public PoC accompany the record. SSVC signals are effectively absent. Two independent limiting factors cut against the network vector: the code path only runs on hosts acting as NFSv4.1 clients (which run a callback service), and the trigger must come from the NFS server side, so an attacker must operate or MITM a malicious/compromised NFSv4.1 server the victim already talks to. CWE is N/A in the input despite this being a clear CWE-457/CWE-763/CWE-908 class bug. Net: a legitimate hardening fix, most credibly a DoS, materially below a 9.8 priority.

A Linux host mounts an NFSv4.1 share from a server the attacker controls or can MITM. When the server issues a CB_SEQUENCE callback containing a validly-formed referring_call_list with zero referring calls, the client decodes it and later calls kfree() on the never-initialized rcl_refcalls pointer (stale slab data), crashing the kernel or corrupting slab memory. No public exploit code has been identified at time of analysis.