Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clnt

Impact

Clients created through the pipefs mount-event path never refreshed clnt->pipefs_sb, and the umount path did not clear it. After a late rpc_pipefs mount or a remount, cleanup compares against the stale pointer and skips removing the directory, leaving pipefs dentries whose inode private data points at a freed rpc_clnt. A later read of the rpc_info file then dereferences freed memory. On a storage-heavy GPU node this is a host-kernel use-after-free in the NFS client plumbing; triggering it requires pipefs mount churn, which is an administrative event rather than something a tenant drives.

Who can reach it

Local, and effectively requires privilege: mounting or remounting rpc_pipefs, or loading the modules that publish it, followed by a read of the affected rpc_info entry.

What to do

Take the stable kernel update that refreshes clnt->pipefs_sb on mount events and clears it on unmount and failure paths (commits in the record). No runtime mitigation beyond avoiding rpc_pipefs mount churn. Kernel upgrade means drain and reboot.

References

Related entries

• Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored
• Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored
• Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored
• Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX boundCVE-2026-89551 · Linux kernel SUNRPC xdr_buf_trim (buf->len underflow)Unscored
• Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-freeCVE-2026-89570 · Linux kernel CXL MCE notifier (per-memdev registration lifetime)Unscored