CVE-2026-89543

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Published Sep 11, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Normal client creation goes through rpc_setup_pipedir(), which records
clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event()
calls rpc_setup_pipedir_sb() directly and never refreshes that field.
The umount path also removes the directory without clearing
clnt->pipefs_sb.

After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()
compares the current superblock against a stale pipefs_sb pointer and
skips cleanup, leaving pipefs dentries whose inode private data still
points at a freed rpc_clnt, leading to a potential use-after-free during
subsequent rpc_info_open() or rpc_show_info() calls.

Fix this by properly updating clnt->pipefs_sb upon mount events and
clearing it during unmount or failure paths.

Analysis

Technical impact

This vulnerability is a use‑after‑free in the Linux kernel sunrpc module caused by a stale clnt->pipefs_sb pointer that is not refreshed during pipefs mount events or cleared during unmounts; when rpc_clnt_remove_pipedir compares the current superblock against this outdated pointer it skips cleanup, leaving dentries that point to freed rpc_clnt structures, which can later be dereferenced by rpc_info_open or rpc_show_info, resulting in kernel memory corruption.

Affected Systems

All Linux kernel installations in which the sunrpc component is available and that have not incorporated commit 932a8cf6abb2b2f8677b79153a823108d8861fe2 – effectively every distribution that ships the default sunrpc module before the patch was applied.

Risk and Exploitability

The CVSS score of 4.1 and an EPSS score below 1% indicate a low likelihood of exploitation, and the vulnerability is not listed in the C, it is inferred that an attacker would need to trigger a pipefs mount or unmount event or generate relevant RPC traffic to create the stale pointer condition, but no specific privilege escalation or remote code execution pathways are detailed by the advisory.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7749fd2dbef72a52b5c9ffdbf877691950ed4680`	affected	< 1a713814e0580f946196bca5e340b37991c6e8bf
`cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a`	affected	< f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< 59527bbfb1eabdb28e95e7c725886cc2c2899cb3
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< cdf7a233cb94774b0e7df42d9157077983f5022c
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< 932a8cf6abb2b2f8677b79153a823108d8861fe2
`17866066b8ac1cc38fb449670bc15dc9fee4b40a`	affected	—
`7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5`	affected	—
`dedf2a0eb9448ae73b270743e6ea9b108189df46`	affected	—
`194454afa6aa9d6ed74f0c57127bc8beb27c20df`	affected	—
`1cdb52ffd6600a37bd355d8dce58ecd03e55e618`	affected	—
`6.1.64`	affected	< 6.1.191
`6.6.3`	affected	< 6.6.160
`4.19.318`	affected	< 4.20
`5.4.280`	affected	< 5.5
`5.10.202`	affected	< 5.11
`5.15.140`	affected	< 5.16
`6.5.13`	affected	< 6.6

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[bfca5fb4e97c46503ddfc582335917b0cc228264,e769fcde3cc73e847b1eb3acd40c04a291cb0c0c)`	affected	code_commit	—
`[bfca5fb4e97c46503ddfc582335917b0cc228264,cdf7a233cb94774b0e7df42d9157077983f5022c)`	affected	code_commit	—
`[bfca5fb4e97c46503ddfc582335917b0cc228264,932a8cf6abb2b2f8677b79153a823108d8861fe2)`	affected	code_commit	—
`17866066b8ac1cc38fb449670bc15dc9fee4b40a`	affected	code_commit	—
`7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5`	affected	code_commit	—
`dedf2a0eb9448ae73b270743e6ea9b108189df46`	affected	code_commit	—
`194454afa6aa9d6ed74f0c57127bc8beb27c20df`	affected	code_commit	—
`7749fd2dbef72a52b5c9ffdbf877691950ed4680`	affected	code_commit	—
`1cdb52ffd6600a37bd355d8dce58ecd03e55e618`	affected	code_commit	—
`cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a`	affected	code_commit	—
`[4.19.318,4.20)`	affected	semver	—
`[5.4.280,5.5)`	affected	semver	—
`[5.10.202,5.11)`	affected	semver	—
`[5.15.140,5.16)`	affected	semver	—
`[6.1.64,6.2)`	affected	semver	—
`[6.5.13,6.6)`	affected	semver	—
`[6.6.3,6.7)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	semver	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 932a8cf6abb2b2f8677b79153a823108d8861fe2, which applies the fix for the use‑after‑free in sunrpc.
If an upgrade is not feasible, disable or unload the sunrpc kernel module to eliminate the vulnerable code path.
Restrict access to RPC services so that only trusted clients can interact with sunrpc, thereby reducing the likelihood that malicious traffic will trigger the stale pointer condition.

Generated by OpenCVE AI on September 15, 2026 at 22:01 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.212% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1a713814e0580f946196bca5e340b37991c6e8bf
https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3
https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2
https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c
https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
https://git.kernel.org/stable/c/f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd
https://nvd.nist.gov/vuln/detail/CVE-2026-89543
https://www.cve.org/CVERecord?id=CVE-2026-89543

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1a713814e0580f946196bca5e340b37991c6e8bf

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd

Sep 21, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89543 https://www.cve.org/CVERecord?id=CVE-2026-89543
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.
Title		sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2 https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c