Executive brief
The Linux kernel's SUNRPC networking subsystem contains a race condition in how it manages socket callbacks when taking over and restoring network sockets. When multiple CPU cores access socket callback pointers simultaneously—one core reading a stale cached copy while another writes a new value—an application can invoke deallocated or incorrect callback functions, potentially causing crashes or memory corruption. This affects servers and clients using NFS and other RPC-based services.
Technical details
The vulnerability is a concurrent access race condition (CWE-366) in the xprtsock socket transport layer. SUNRPC temporarily replaces socket callbacks (sk_data_ready, sk_write_space) with its own handlers, then restores the original callbacks during cleanup. The code performs these pointer updates with plain loads and stores, which the compiler or CPU may optimize or reorder on multi-core systems. A concurrent reader may hold a stale snapshot of the callback pointer and invoke it after the pointer has been restored to the original handler, causing execution of deallocated code or memory corruption. The fix adds READ_ONCE() and WRITE_ONCE() compiler barriers in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), xs_restore_old_callbacks(), and xs_udp_do_set_buffer_size() to enforce strict visibility of callback pointer changes across CPUs. No authentication or network access is required; any system running affected kernel versions with SUNRPC/NFS enabled is vulnerable.
Affected products
- Linux Linux Kernel all versions prior to commit 33930840b5f0a79f826e7c69dc6cd78f72a67481
Timeline
- 2026-09-17: disclosed: CVE-2026-90235 published
- 2026-08-10: patched: Upstream kernel patch merged by Trond Myklebust
- 2026-09-14: patched: Stable kernel backport applied by Greg Kroah-Hartman