Is CVE-2026-90235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90235 being exploited in the wild.

How severe is CVE-2026-90235?

Critical severity, with a CVSS score of 9.8, published 17 September 2026.

Which products and versions are affected?

Linux Kernel all versions prior to commit 33930840b5f0a79f826e7c69dc6cd78f72a67481.

Is there a fix for CVE-2026-90235?

A patch was published on 2026-08-10: Upstream kernel patch merged by Trond Myklebust Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90235 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-90235?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90235: Linux kernel SUNRPC xprtsock race condition in socket callback handling

CVE-2026-90235 · Severity: critical · CVSS 9.8 · Published 2026-09-17

The Linux kernel's SUNRPC networking subsystem contains a race condition in how it manages socket callbacks when taking over and restoring network sockets. When multiple CPU cores access socket callback pointers simultaneously—one core reading a stale cached copy while another writes a new value—an application can invoke deallocated or incorrect callback functions, potentially causing crashes or memory corruption. This affects servers and clients using NFS and other RPC-based services.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-90235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90235 being exploited in the wild.
How severe is CVE-2026-90235?: Critical severity, with a CVSS score of 9.8, published 17 September 2026.
Which products and versions are affected?: Linux Kernel all versions prior to commit 33930840b5f0a79f826e7c69dc6cd78f72a67481.
Is there a fix for CVE-2026-90235?: A patch was published on 2026-08-10: Upstream kernel patch merged by Trond Myklebust Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90235 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-90235?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a concurrent access race condition (CWE-366) in the xprtsock socket transport layer. SUNRPC temporarily replaces socket callbacks (sk_data_ready, sk_write_space) with its own handlers, then restores the original callbacks during cleanup. The code performs these pointer updates with plain loads and stores, which the compiler or CPU may optimize or reorder on multi-core systems. A concurrent reader may hold a stale snapshot of the callback pointer and invoke it after the pointer has been restored to the original handler, causing execution of deallocated code or memory corruption. The fix adds READ_ONCE() and WRITE_ONCE() compiler barriers in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), xs_restore_old_callbacks(), and xs_udp_do_set_buffer_size() to enforce strict visibility of callback pointer changes across CPUs. No authentication or network access is required; any system running affected kernel versions with SUNRPC/NFS enabled is vulnerable.

Affected products

Linux Linux Kernel all versions prior to commit 33930840b5f0a79f826e7c69dc6cd78f72a67481

Timeline

2026-09-17: disclosed: CVE-2026-90235 published
2026-08-10: patched: Upstream kernel patch merged by Trond Myklebust
2026-09-14: patched: Stable kernel backport applied by Greg Kroah-Hartman

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.