# CVE-2026-90104

Linux NFSv4.1 kernel bug causing memory corruption via uninitialized callback lists.

- Page: https://www.vulneraibility.com/cve/CVE-2026-90104
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.68% (percentile 52.5)
- Published: 2026-09-17

## Affected versions

- Linux: affected >= 4aece6a19cf7f474f15eb861ba74db4479884ce3 and < f31f3c042e024aef437cda42f0424ae8d4594b6c; >= 4aece6a19cf7f474f15eb861ba74db4479884ce3 and < 8fa4804fe62ca4155a2d8fc2789d630376cbf2fc; 2.6.31; fixed in < 2.6.31, >= 7.2.6 and <= 7.2.*, >= 7.3-rc1 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote kernel memory corruption via NFSv4.1 callback handling; can cause DoS (kernel panic) and potentially privilege escalation or RCE.

## Action

Immediate action required

## Recommendation

Install vendor kernel update or apply the kernel patch; disable NFSv4.1 callbacks if unpatchable.

## References

- [other] https://git.kernel.org/stable/c/810f6b3a29ac96fdc16909132b31627dae6824c2
- [other] https://git.kernel.org/stable/c/ed54460caf5b5aa65ec03c9a6032d831f39f19f5
- [other] https://git.kernel.org/stable/c/7510a5b9edec9d9536a4e69f10edfb2592e6cf7f
- [other] https://git.kernel.org/stable/c/f4d23937e1c41995c2f54af26c89b5e48a41c299
- [other] https://git.kernel.org/stable/c/f31f3c042e024aef437cda42f0424ae8d4594b6c
- [other] https://git.kernel.org/stable/c/8fa4804fe62ca4155a2d8fc2789d630376cbf2fc

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.