CVE-2026-89545
Received Received - Intake

Use-After-Free in Linux Kernel SunRPC

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), but defers the rqstp struct free via kfree_rcu(). After svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is a window where RCU readers that started before list_del_rcu() can still traverse the thread list and find the rqstp. These readers (e.g. nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has already been freed — a use-after-free. Fix this by moving the kfree of rq_argp and rq_resp into an explicit call_rcu() callback alongside the struct free. Resources not accessed by RCU readers (bvec, buffer pages, scratch folio, auth_data) remain synchronously freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89545
EUVD
EUVD-2026-76456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's sunrpc module. It occurs when rq_argp and rq_resp are freed synchronously while the rqstp struct is freed asynchronously via RCU. This creates a window where RCU readers may still access freed memory, leading to potential crashes or code execution.

Impact Analysis

If exploited, this could cause system instability, crashes, or arbitrary code execution on affected Linux systems. It primarily affects systems using NFS (Network File System) services, as the vulnerable code is part of the sunrpc module which handles remote procedure calls.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free issue in sunrpc. Monitor kernel security advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart