CVE-2026-90104

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: zero referring call lists before decoding

decodecbsequenceargs() allocates csarclists with kmalloc_objs(), so

each referringcalllist starts uninitialized. decoderclist() assigns

rclrefcalls only when rclnrefcalls is nonzero. A valid list with zero

referring calls therefore leaves the pointer uninitialized, and

nfs4callbacksequence() later passes stale slab contents to kfree().

Allocate csarclists with kzallocobjs() so every rcl_refcalls member is

NULL from the beginning, including valid empty referring call lists.