CVE-2026-90235 - Vulnerability Details

- sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

xprtsock replaces and restores sk->sk_data_ready and
sk->sk_write_space on live sockets with plain stores, and
xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain
load. These callback pointers are shared with generic socket and
protocol paths that may read or invoke them concurrently, so xprtsock
needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract
that the validated 4022 family applied elsewhere.

When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later
restores the lower-socket callbacks during teardown, another CPU may
still hold an earlier callback snapshot. The plain replace/restore
pattern leaves the same visibility hole as the validated 4022 family,
so a stale snapshot can still invoke xs_data_ready() or
xs_udp_write_space() after the live callback fields have already been
restored to the lower-socket handlers.

Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space
stores in xs_local_finish_connecting(), xs_udp_finish_connecting(),
xs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use
READ_ONCE() for the direct sk_write_space invocation in
xs_udp_do_set_buffer_size(). This matches the required callback
visibility contract while leaving adjacent sk_state_change and
sk_error_report handling unchanged.

Published: 2026-09-17

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SUNRPC module has a race condition in the handling of shared socket callbacks, allowing a stale snapshot of callback pointers to be invoked after the lower‑level socket handlers have been restored. This flaw can lead to execution of unintended kernel code or memory corruption, effectively enabling arbitrary code execution within the kernel.

Affected Systems

The vulnerability affects the Linux kernel in general; no specific version range is listed in the provided data. All systems running a Linux kernel that includes the SUNRPC module without the applied patch are potentially impacted.

Risk and Exploitability

The CVSS score of 9.8 classifies this flaw as critical, and the EPSS score of < 1% suggests a low current exploitation probability. The flaw is not listed in CISA KEV, indicating no confirmed widespread attacks yet. The likely attack vector is local, requiring an attacker with ability to open SUNRPC sockets and trigger the timing conditions that lead to the stale callback invocation. Exploitation would result in privilege escalation or kernel compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a246b0105bbd9a70a698f69baae2042996f2a0e9`	affected	< ed80d009b154aa204f541d390884851b3d4f15ae
`a246b0105bbd9a70a698f69baae2042996f2a0e9`	affected	< 589f761236e05ff9de1bdfd6a5258f113e6457fe
`a246b0105bbd9a70a698f69baae2042996f2a0e9`	affected	< da652cb17f9faeea1fa44b7215e8869a0b10b664
`a246b0105bbd9a70a698f69baae2042996f2a0e9`	affected	< d8f0b83753809761a560c4b33249388548ba6e43
`a246b0105bbd9a70a698f69baae2042996f2a0e9`	affected	< 33930840b5f0a79f826e7c69dc6cd78f72a67481

Linux

affected

Version	Status	Constraints
`2.6.15`	affected	—
`0`	unaffected	< 2.6.15
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a246b0105bbd9a70a698f69baae2042996f2a0e9,ed80d009b154aa204f541d390884851b3d4f15ae)`	affected	code_commit	—
`[a246b0105bbd9a70a698f69baae2042996f2a0e9,589f761236e05ff9de1bdfd6a5258f113e6457fe)`	affected	code_commit	—
`[a246b0105bbd9a70a698f69baae2042996f2a0e9,d8f0b83753809761a560c4b33249388548ba6e43)`	affected	code_commit	—
`[a246b0105bbd9a70a698f69baae2042996f2a0e9,da652cb17f9faeea1fa44b7215e8869a0b10b664)`	affected	code_commit	—
`[a246b0105bbd9a70a698f69baae2042996f2a0e9,33930840b5f0a79f826e7c69dc6cd78f72a67481)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.15`	affected	semver	—
`[0,2.6.15)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the XPRTSOCK READ_ONCE/WRITE_ONCE patch; this is the most effective remedy.
If the update cannot be applied immediately, disable Sun RPC-related services or sockets to prevent the vulnerability from being exercised.
Monitor system logs for anomalous SUNRPC activity and consider using kernel hardening options such as CONFIG_SYSCTL to restrict SUNRPC usage.

Generated by OpenCVE AI on September 20, 2026 at 01:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00671.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481
https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe
https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43
https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664
https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae

History

Sun, 20 Sep 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and restores sk->sk_data_ready and sk->sk_write_space on live sockets with plain stores, and xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain load. These callback pointers are shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract that the validated 4022 family applied elsewhere. When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot can still invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have already been restored to the lower-socket handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent sk_state_change and sk_error_report handling unchanged.
Title		sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481 https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43 https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664 https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:07:41.251Z

Updated: 2026-09-18T17:54:01.752Z

Reserved: 2026-09-11T19:38:34.794Z

Link: CVE-2026-90235

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:19.400

Modified: 2026-09-18T18:17:48.413

Link: CVE-2026-90235

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T01:15:07Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object