Executive brief
The Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem manages caches for network operations. A flaw in the cache cleanup logic can cause the kernel to access freed memory, leading to potential system crashes or privilege escalation when network namespaces are torn down.
Technical details
The vulnerability is a use-after-free in sunrpc_destroy_cache_detail(). The function only cancels the global cache_cleaner delayed_work when the cache list is empty. During per-netns teardown, the cache list is never empty (init_net's caches remain registered), so cancel_delayed_work_sync() never executes. After unlink, cache_detail is freed while cache_clean() may still hold a dangling pointer, causing cache_dequeue() to dereference cd->queue_lock on freed memory and cache_put() to call a function pointer from freed slab. The fix unconditionally runs cancel_delayed_work_sync() to ensure in-flight operations complete before freeing, then re-arms the cleaner if other caches remain.
Affected products
- Linux Linux kernel multiple versions (patched in 2026-05-26, backported to stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89548 published
- 2026-05-26: patched: Fix committed upstream by Jeff Layton
- 2026-09-07: patched: Backported to stable kernel branches