Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-89543

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7749fd2dbef72a52b5c9ffdbf877691950ed4680 to < 1a713814e0580f946196bca5e340b37991c6e8bfaffected
  • cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a to < f99fedfd1dbffe8d20b421c9a7d4655a135d4fcdaffected
  • bfca5fb4e97c46503ddfc582335917b0cc228264 to < 59527bbfb1eabdb28e95e7c725886cc2c2899cb3affected
  • bfca5fb4e97c46503ddfc582335917b0cc228264 to < e769fcde3cc73e847b1eb3acd40c04a291cb0c0caffected
  • bfca5fb4e97c46503ddfc582335917b0cc228264 to < cdf7a233cb94774b0e7df42d9157077983f5022caffected
  • bfca5fb4e97c46503ddfc582335917b0cc228264 to < 932a8cf6abb2b2f8677b79153a823108d8861fe2affected
  • 17866066b8ac1cc38fb449670bc15dc9fee4b40aaffected
  • 7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5affected
  • dedf2a0eb9448ae73b270743e6ea9b108189df46affected
  • 194454afa6aa9d6ed74f0c57127bc8beb27c20dfaffected
  • 1cdb52ffd6600a37bd355d8dce58ecd03e55e618affected
  • 6.1.64 to < 6.1.191affected
  • 6.6.3 to < 6.6.160affected
  • 4.19.318 to < 4.20affected
  • 5.4.280 to < 5.5affected
  • 5.10.202 to < 5.11affected
  • 5.15.140 to < 5.16affected
  • 6.5.13 to < 6.6affected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References