Executive brief
The Linux kernel's Sun RPC (Remote Procedure Call) subsystem had a flaw in how it deallocates request structures. When threads serving remote procedure calls are shut down, request data structures were freed immediately while other kernel code could still access them through the RCU (Read-Copy-Update) synchronization mechanism, leading to use-after-free vulnerabilities. An attacker with network access to an NFS server could trigger this condition to cause denial of service or potentially execute arbitrary code.
Technical details
The vulnerability is a use-after-free in the Sun RPC subsystem's svc_rqst_free() function. The root cause is a race condition in memory deallocation ordering: rq_argp and rq_resp were freed synchronously via kfree() while the rqstp structure itself was freed via kfree_rcu() (deferred). After svc_exit_thread() calls list_del_rcu(), RCU readers that started before this point can still traverse the thread list and dereference the already-freed rqstp->rq_argp and rqstp->rq_resp pointers, particularly in code paths like nfsd_nl_rpc_status_get_dumpit(). The fix moves both kfree(rq_argp) and kfree(rq_resp) into an explicit call_rcu() callback alongside the struct free, ensuring they remain valid until after the RCU grace period expires. Network-reachable NFS services (nfsd) are affected by default.
Affected products
- Linux Linux Kernel multiple versions (see git stable tree references)
Timeline
- 2026-09-11: disclosed: CVE-2026-89545 published
- 2026-06-11: patched: Upstream fix committed by Jeff Layton
- 2026-09-07: patched: Stable tree backport merged