CVE-2026-89545 (GCVE-0-2026-89545)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-21 13:14
VLAI
Title
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), but defers the rqstp struct free via kfree_rcu(). After svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is a window where RCU readers that started before list_del_rcu() can still traverse the thread list and find the rqstp. These readers (e.g. nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has already been freed — a use-after-free. Fix this by moving the kfree of rq_argp and rq_resp into an explicit call_rcu() callback alongside the struct free. Resources not accessed by RCU readers (bvec, buffer pages, scratch folio, auth_data) remain synchronously freed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 812443865c5fc255363d4a684a62c086af1addca , < 0ea49d69aa806008b2424c8cf21cf746b9963967 (git)
Affected: 812443865c5fc255363d4a684a62c086af1addca , < 08bc49e0541260bf294962cf889a32a2d2713ad6 (git)
Affected: 812443865c5fc255363d4a684a62c086af1addca , < e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090 (git)
Affected: 812443865c5fc255363d4a684a62c086af1addca , < c479bde671cbe2f9e152834a8b0eb7c3c295bbaf (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ea49d69aa806008b2424c8cf21cf746b9963967",
              "status": "affected",
              "version": "812443865c5fc255363d4a684a62c086af1addca",
              "versionType": "git"
            },
            {
              "lessThan": "08bc49e0541260bf294962cf889a32a2d2713ad6",
              "status": "affected",
              "version": "812443865c5fc255363d4a684a62c086af1addca",
              "versionType": "git"
            },
            {
              "lessThan": "e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090",
              "status": "affected",
              "version": "812443865c5fc255363d4a684a62c086af1addca",
              "versionType": "git"
            },
            {
              "lessThan": "c479bde671cbe2f9e152834a8b0eb7c3c295bbaf",
              "status": "affected",
              "version": "812443865c5fc255363d4a684a62c086af1addca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: defer rq_argp and rq_resp free until after RCU grace period\n\nsvc_rqst_free() frees rqstp-\u003erq_argp and rqstp-\u003erq_resp synchronously\nvia kfree(), but defers the rqstp struct free via kfree_rcu().  After\nsvc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is\na window where RCU readers that started before list_del_rcu() can still\ntraverse the thread list and find the rqstp.  These readers (e.g.\nnfsd_nl_rpc_status_get_dumpit()) dereference rqstp-\u003erq_argp, which has\nalready been freed \u2014 a use-after-free.\n\nFix this by moving the kfree of rq_argp and rq_resp into an explicit\ncall_rcu() callback alongside the struct free.  Resources not accessed\nby RCU readers (bvec, buffer pages, scratch folio, auth_data) remain\nsynchronously freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is reached by NFSD_CMD_RPC_STATUS_GET, a generic-netlink dump over AF_NETLINK that walks svc_rqst threads and reads rq_argp; remote NFS RPCs never enter nfsd_nl_rpc_status_get_dumpit().\nAC:L - The attacker fully controls the dumpit reader and can loop it while nfsd threads exit (dynamic idle-timeout kills or thread-count changes), and can further churn threads with NFS traffic; this is an attacker-driven RCU race, not a condition beyond their control.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so any unprivileged process in the nfsd network namespace can invoke the dump; exploiting it does not require CAP_NET_ADMIN or root.\nUI:N - The attacker issues the netlink dump themselves; no separate victim action such as mounting a filesystem or opening a device is required.\nS:U - This is a kernel-heap use-after-free in sunrpc/nfsd on the local host; impact stays inside the kernel\u0027s security authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - dumpit dereferences the kfree\u0027d rq_argp (nfsd4_compoundargs) and reads opcnt/opnums under rcu_read_lock; a kernel UAF with heap reuse of that object yields an arbitrary read primitive.\nI:H - The same slab UAF is heap-sprayable so a replaced rq_argp can make dumpit walk attacker-controlled args-\u003eops[], enabling kernel memory corruption and control-flow hijacking.\nA:H - Use-after-free of rq_argp while an RCU reader still holds the svc_rqst from sp_all_threads can oops or panic the kernel even if the UAF is not fully turned into code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:14:26.005Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967"
        },
        {
          "url": "https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090"
        },
        {
          "url": "https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"
        }
      ],
      "title": "sunrpc: defer rq_argp and rq_resp free until after RCU grace period",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89545",
    "datePublished": "2026-09-11T19:44:21.161Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-09-21T13:14:26.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89545",
      "date": "2026-09-21",
      "epss": "0.00157",
      "percentile": "0.05261"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:58:05.000Z",
      "cve": "CVE-2026-89545",
      "id": "msrc_CVE-2026-89545",
      "initial_release_date": "2026-09-13T01:10:46.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sunrpc: defer rq_argp and rq_resp free until after RCU grace period",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89545.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0ea49d69aa806008b2424c8cf21cf746b9963967",
                    "status": "affected",
                    "version": "812443865c5fc255363d4a684a62c086af1addca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08bc49e0541260bf294962cf889a32a2d2713ad6",
                    "status": "affected",
                    "version": "812443865c5fc255363d4a684a62c086af1addca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090",
                    "status": "affected",
                    "version": "812443865c5fc255363d4a684a62c086af1addca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c479bde671cbe2f9e152834a8b0eb7c3c295bbaf",
                    "status": "affected",
                    "version": "812443865c5fc255363d4a684a62c086af1addca",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/svc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: defer rq_argp and rq_resp free until after RCU grace period\n\nsvc_rqst_free() frees rqstp-\u003erq_argp and rqstp-\u003erq_resp synchronously\nvia kfree(), but defers the rqstp struct free via kfree_rcu().  After\nsvc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is\na window where RCU readers that started before list_del_rcu() can still\ntraverse the thread list and find the rqstp.  These readers (e.g.\nnfsd_nl_rpc_status_get_dumpit()) dereference rqstp-\u003erq_argp, which has\nalready been freed \u2014 a use-after-free.\n\nFix this by moving the kfree of rq_argp and rq_resp into an explicit\ncall_rcu() callback alongside the struct free.  Resources not accessed\nby RCU readers (bvec, buffer pages, scratch folio, auth_data) remain\nsynchronously freed."
          }
        ],
        "id": "CVE-2026-89545",
        "lastModified": "2026-09-21T14:17:23.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:37.840",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-18T15:17:38+00:00",
      "cve": "CVE-2026-89545",
      "id": "CVE-2026-89545",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "262",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sunrpc: defer rq_argp and rq_resp free until after RCU grace period",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89545.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T15:37:05Z",
      "cve": "CVE-2026-89545",
      "id": "CVE-2026-89545",
      "initial_release_date": "2026-09-16T15:37:05Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89545",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89545.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.