Executive brief
The Linux kernel's RPC (Remote Procedure Call) implementation has a memory safety bug in how it manages pipe filesystem (pipefs) directory references during mount and unmount events. An attacker or local process could trigger cleanup code to reference freed memory, potentially enabling information disclosure or system crashes through subsequent file operations on RPC client pipes.
Technical details
This is a use-after-free vulnerability in the sunrpc subsystem's client pipedir management code (net/sunrpc/clnt.c). The root cause is that __rpc_clnt_handle_event() updates RPC client state during pipefs mount events but fails to refresh the clnt->pipefs_sb pointer consistently, and the unmount path does not clear this pointer. After a late pipefs mount or remount, stale superblock pointers cause rpc_clnt_remove_pipedir() to skip cleanup, leaving dentries with inode private data pointing to freed rpc_clnt structures. Subsequent calls to rpc_info_open() or rpc_show_info() access the freed memory. Attack requires local access and ability to trigger pipefs mount/unmount events. The fix properly updates clnt->pipefs_sb during mount events and clears it during unmount or failure paths.
Affected products
- Linux Linux kernel Multiple versions (see stable tree branches); fix in 932a8cf6abb2b2f8677b79153a823108d8861fe2
Timeline
- 2026-09-11: disclosed: CVE-2026-89543 published
- 2026-08-17: patched: Upstream fix commit 932a8cf6abb2b2f8677b79153a823108d8861fe2 merged
- 2026-09-21: patched: Fix backported to stable tree (commit 59527bbfb1eabdb28e95e7c725886cc2c2899cb3)