Executive brief
The Linux kernel's SUNRPC subsystem, which handles remote procedure call communication for network services like NFS, contains a race condition in its TLS handshake callback mechanism. An attacker can trigger a use-after-free condition by timing network timeouts or signals during the TLS handshake setup, potentially allowing arbitrary code execution on systems using SUNRPC-based services.
Technical details
The vulnerability exists in the xs_tls_handshake_sync() function in net/sunrpc/xprtsock.c, which manages the synchronous TLS handshake for RPC transport connections. A race condition occurs when a handshake timeout or signal interrupt happens after handshake_complete() has already marked the request complete but before the completion callback (xs_tls_handshake_done()) finishes execution. The waiter drops its transport reference via tls_handshake_cancel(), which returns false in this race scenario, causing the lower transport to be freed while the callback is still in flight and accessing it. An attacker with network-level access can trigger timeouts or send signals to exploit this, achieving use-after-free memory corruption. The fix ensures the waiter waits for the callback to complete before returning when the race is detected, keeping reference lifetimes synchronized.
Affected products
- Linux Linux kernel versions with TCP-with-TLS RPC transport (introduced by commit 75eb6af7acdf onwards)
Timeline
- 2026-09-11: disclosed: CVE-2026-89536 published
- 2026-08-09: patched: Commit a89dd597458848b463d284b15e42a8078beeb046 authored, backported to stable branches