Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completion

Impact

On an RPC-with-TLS mount, a handshake that times out or is interrupted by a signal can drop a reference that the completion callback still owns, freeing the lower transport while xs_tls_handshake_done() is still writing to it. The result is a use-after-free in the storage path of the host kernel, which on a GPU node means a kernel oops or worse on the machine holding running training jobs. Nodes that mount TLS-protected NFS for dataset or checkpoint traffic hit this path on every handshake that does not complete cleanly, so a flaky or slow handshake peer widens the window. Exposure is limited to fleets that actually enable RPC TLS; plain NFS mounts do not reach this code.

Who can reach it

No authentication of an attacker is required in the usual sense: the race is driven by handshake timeouts or signals against a TLS-enabled RPC mount, so a peer or network condition that stalls the handshake, or any local process that interrupts a mount, can drive it. It is not a remotely controllable primitive on its own.

What to do

Take the stable kernel update carrying the fix (commits linked in the record); there is no runtime mitigation short of not using RPC TLS. Applying it means installing the patched kernel and rebooting each node, so plan a drain-and-reboot pass across the fleet rather than a live fix.

References

Related entries

• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored
• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored
• Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored
• Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored
• Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored
• Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored