Linux kernel sunrpc: use-gss-proxy proc entry published before its mutex is initialized

Impact

create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy before init_gssp_clnt() initializes sn->gssp_lock, so a write landing in the two-statement window locks a zero-filled struct mutex. On a production kernel the fast path acquires it via cmpxchg, which lets a second writer enter set_gssp_clnt() concurrently, shut down the first writer's RPC client while it is still in use, and leak the loser's client. The window widens on auth_rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. This matters on Kerberized NFS servers and clients in shared clusters; the fix moves the mutex init into sunrpc_init_net() so its lifetime matches the namespace.

Who can reach it

Local, privileged. Requires write access to /proc/net/rpc/use-gss-proxy (root in the namespace) timed against auth_rpcgss module load or pernet registration - a narrow race, not a drive-by.

What to do

Pick up a stable kernel with commit f15b87521168 or its backport and reboot. The exposure is limited to hosts that load auth_rpcgss (Kerberos NFS); nodes not using gssproxy can be deprioritized.

References

Related entries

• Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dumpCVE-2026-89690 · Linux kernel nfsd (nfsd4_release_compoundargs / rpc_status netlink dump)High
• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High