CVE-2026-89543 - Vulnerability Details

- sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Normal client creation goes through rpc_setup_pipedir(), which records
clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event()
calls rpc_setup_pipedir_sb() directly and never refreshes that field.
The umount path also removes the directory without clearing
clnt->pipefs_sb.

After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()
compares the current superblock against a stale pipefs_sb pointer and
skips cleanup, leaving pipefs dentries whose inode private data still
points at a freed rpc_clnt, leading to a potential use-after-free during
subsequent rpc_info_open() or rpc_show_info() calls.

Fix this by properly updating clnt->pipefs_sb upon mount events and
clearing it during unmount or failure paths.

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a use‑after‑free in the Linux kernel sunrpc module caused by a stale clnt->pipefs_sb pointer that is not refreshed during pipefs mount events or cleared during unmounts; when rpc_clnt_remove_pipedir compares the current superblock against this outdated pointer it skips cleanup, leaving dentries that point to freed rpc_clnt structures, which can later be dereferenced by rpc_info_open or rpc_show_info, resulting in kernel memory corruption.

Affected Systems

All Linux kernel installations in which the sunrpc component is available and that have not incorporated commit 932a8cf6abb2b2f8677b79153a823108d8861fe2 – effectively every distribution that ships the default sunrpc module before the patch was applied.

Risk and Exploitability

The CVSS score of 4.1 and an EPSS score below 1% indicate a low likelihood of exploitation, and the vulnerability is not listed in the C, it is inferred that an attacker would need to trigger a pipefs mount or unmount event or generate relevant RPC traffic to create the stale pointer condition, but no specific privilege escalation or remote code execution pathways are detailed by the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< 59527bbfb1eabdb28e95e7c725886cc2c2899cb3
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< cdf7a233cb94774b0e7df42d9157077983f5022c
`bfca5fb4e97c46503ddfc582335917b0cc228264`	affected	< 932a8cf6abb2b2f8677b79153a823108d8861fe2
`17866066b8ac1cc38fb449670bc15dc9fee4b40a`	affected	—
`7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5`	affected	—
`dedf2a0eb9448ae73b270743e6ea9b108189df46`	affected	—
`194454afa6aa9d6ed74f0c57127bc8beb27c20df`	affected	—
`7749fd2dbef72a52b5c9ffdbf877691950ed4680`	affected	—
`1cdb52ffd6600a37bd355d8dce58ecd03e55e618`	affected	—
`cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a`	affected	—
`4.19.318`	affected	< 4.20
`5.4.280`	affected	< 5.5
`5.10.202`	affected	< 5.11
`5.15.140`	affected	< 5.16
`6.1.64`	affected	< 6.2
`6.5.13`	affected	< 6.6
`6.6.3`	affected	< 6.7

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.111`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bfca5fb4e97c46503ddfc582335917b0cc228264,e769fcde3cc73e847b1eb3acd40c04a291cb0c0c)`	affected	code_commit	—
`[bfca5fb4e97c46503ddfc582335917b0cc228264,cdf7a233cb94774b0e7df42d9157077983f5022c)`	affected	code_commit	—
`[bfca5fb4e97c46503ddfc582335917b0cc228264,932a8cf6abb2b2f8677b79153a823108d8861fe2)`	affected	code_commit	—
`17866066b8ac1cc38fb449670bc15dc9fee4b40a`	affected	code_commit	—
`7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5`	affected	code_commit	—
`dedf2a0eb9448ae73b270743e6ea9b108189df46`	affected	code_commit	—
`194454afa6aa9d6ed74f0c57127bc8beb27c20df`	affected	code_commit	—
`7749fd2dbef72a52b5c9ffdbf877691950ed4680`	affected	code_commit	—
`1cdb52ffd6600a37bd355d8dce58ecd03e55e618`	affected	code_commit	—
`cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a`	affected	code_commit	—
`[4.19.318,4.20)`	affected	semver	—
`[5.4.280,5.5)`	affected	semver	—
`[5.10.202,5.11)`	affected	semver	—
`[5.15.140,5.16)`	affected	semver	—
`[6.1.64,6.2)`	affected	semver	—
`[6.5.13,6.6)`	affected	semver	—
`[6.6.3,6.7)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	semver	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 932a8cf6abb2b2f8677b79153a823108d8861fe2, which applies the fix for the use‑after‑free in sunrpc.
If an upgrade is not feasible, disable or unload the sunrpc kernel module to eliminate the vulnerable code path.
Restrict access to RPC services so that only trusted clients can interact with sunrpc, thereby reducing the likelihood that malicious traffic will trigger the stale pointer condition.

Generated by OpenCVE AI on September 15, 2026 at 22:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3
https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2
https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c
https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
https://nvd.nist.gov/vuln/detail/CVE-2026-89543
https://www.cve.org/CVERecord?id=CVE-2026-89543

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89543 https://www.cve.org/CVERecord?id=CVE-2026-89543
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.
Title		sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2 https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:19.679Z

Updated: 2026-09-21T13:14:23.795Z

Reserved: 2026-09-11T19:38:34.722Z

Link: CVE-2026-89543

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:37.520

Modified: 2026-09-21T14:17:22.840

Link: CVE-2026-89543

Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:19Z

Links: CVE-2026-89543 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:15:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object