Linux kernel SUNRPC client: use-after-free on the upper rpc_clnt when a TLS mount handshake fails fatally

Impact

xs_connect() stores task->tk_client in sock_xprt::clnt as a raw pointer and queues the delayed connect worker. For TLS transports that worker is xs_tcp_tls_setup_socket(), which reads cl_timeout, cl_program, cl_prog, cl_vers, cl_cred and cl_stats out of that pointer. Nothing pins the rpc_clnt: the xprt cannot be destroyed until the client releases it, so cancellation in xs_destroy() never runs in time. A fatal TLS failure - the reported case is an mTLS mount whose client certificate does not match the server - wakes the task with -EACCES, the mount caller runs rpc_shutdown_client(), and the still-queued worker then dereferences freed memory, producing a refcount_t underflow. This bites GPU nodes mounting NFS-over-TLS datasets: a certificate rotation gone wrong turns a failed mount into kernel memory corruption on the compute node rather than a clean error.

Who can reach it

Local - triggered on the client node by a mount attempt whose TLS handshake fails fatally. Any user able to initiate such a mount, or an operator whose certificates have expired or been rotated, reaches it; an NFS server that rejects client certificates can induce it on every node that mounts from it.

What to do

Apply the stable-kernel fix, which adds rpc_hold_client() in xs_connect() for TLS transports and releases it in the connect worker's exit path. Kernel update plus reboot on each client node - that means draining GPU jobs node by node across the fleet. Until then, keep client certificates valid and avoid repeated failing mTLS mount attempts. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel NFS client: file lock list traversed without nfsi->rwsem, allowing use-after-free on lock structuresCVE-2026-72472 · Linux kernel NFS client (file lock list traversal during delegation recall and state recovery)Critical
• Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request duringCVE-2026-74345 · Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation)Critical
• Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement indexCVE-2026-74361 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (drivers/nvme/host): The multipath current-path array is sized by the count of possible NUMA nodes butCVE-2026-74384 · Linux kernel (drivers/nvme/host)Critical