Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cache

Impact

sunrpc_destroy_cache_detail() only cancelled the global cache_cleaner delayed work when the cache list was empty, which never happens during per-netns teardown because init_net's caches stay registered. The cache_detail is then freed while cache_clean() may still hold a pointer to it, so cache_dequeue() takes a spinlock in freed slab memory and cache_put() calls a function pointer read out of freed memory. On a GPU node this is the NFS/RPC client and server path: any workflow that creates and destroys network namespaces with RPC caches in them (containers mounting NFS, per-tenant netns) can drive the race. A function pointer read from reclaimed slab is the kind of primitive that turns a crash into privilege escalation if an attacker can groom the allocator.

Who can reach it

Local. A user or workload able to create and tear down network namespaces that register RPC caches - which in practice includes container workloads on the node - can reach the racing teardown path. No remote reachability, no authentication beyond local execution on the node.

What to do

Take the stable kernel update carrying the fix (the list_empty guard is dropped so cancel_delayed_work_sync() always runs). No runtime mitigation is available inside the kernel, so each node must be drained and rebooted onto the patched kernel; for a GPU fleet that means an eviction and reload cycle per node. The four stable commits are linked in the record; the advisory gives no fixed release numbers.

References

Related entries

• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored
• Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX boundCVE-2026-89551 · Linux kernel SUNRPC xdr_buf_trim (buf->len underflow)Unscored
• Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-freeCVE-2026-89570 · Linux kernel CXL MCE notifier (per-memdev registration lifetime)Unscored
• Linux kernel CXL fwctl: unchecked op_size reads past the input buffer and into the device mailboxCVE-2026-89571 · Linux kernel CXL features fwctl (cxlctl_fw_rpc op_size validation)Unscored
• Linux kernel BPF: preemptible bpf_get_stack reuses a per-CPU callchain buffer and writes out of boundsCVE-2026-89580 · Linux kernel BPF __bpf_get_stack (per-CPU callchain entry reuse)Unscored
• Linux kernel BPF x86 JIT: per-CPU address lands in the wrong register, clobbering RAX or the frame pointerCVE-2026-89581 · Linux kernel BPF x86-64 JIT (per-CPU address MOV register encoding)Unscored