CVE-2026-89548

Received Received - Intake

Use-After-Free in Linux Kernel SUNRPC Cache

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89548

EUVD

EUVD-2026-76459

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SUNRPC subsystem. It occurs when a cache_detail structure is freed while cache_clean() may still be using it. The issue stems from sunrpc_destroy_cache_detail() not properly canceling cache_cleaner delayed work before destroying the cache_detail, leading to a dangling pointer dereference when cache_dequeue() locks freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's SUNRPC subsystem and may not have direct network detection methods. Monitor kernel logs for use-after-free errors or crashes related to SUNRPC cache operations. Check for kernel oops or panic messages after unloading SUNRPC modules or during network service teardown.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. Systems running vulnerable Linux kernel versions could crash or become unstable due to memory corruption.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. If immediate patching is not possible, avoid unloading or restarting SUNRPC-related services during high-load periods. Monitor system stability and kernel logs for signs of use-after-free errors.

Hi! I’m here to help you understand CVE-2026-89548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70