Executive brief
The Linux kernel's sunrpc module has a race condition in how it initializes a synchronization lock (gssp_lock) used to protect concurrent access to authentication credentials. An attacker with local access can exploit a narrow timing window to trigger uninitialized lock behavior, potentially causing system crashes or authentication service disruption. This affects systems where auth_rpcgss is loaded, particularly in containerized or multi-namespace environments.
Technical details
The vulnerability is a race condition (CWE-362) in sunrpc's GSS proxy initialization. The proc entry for /proc/net/rpc/use-gss-proxy is published via proc_create_data() before mutex_init() is called on sn->gssp_lock, creating a window where userspace can write to the file and trigger set_gssp_clnt() with an uninitialized mutex. On CONFIG_DEBUG_MUTEXES kernels this causes a "lock used without init" panic; on production kernels, concurrent writers can perform CMPXCHG on the zeroed mutex, bypass the lock, and corrupt gssp_clnt state. The race is widened during auth_rpcgss module load when the proc entry is created for every existing network namespace. The fix moves mutex_init() to sunrpc_init_net() so initialization occurs before any proc entry publication.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory