CVE-2026-89536: Linux Kernel SUNRPC Use-After-Free Vulnerability

CVE-2026-89536 Overview

CVE-2026-89536 is a use-after-free vulnerability in the Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem. The flaw resides in the client-side TLS handshake path, specifically in xs_tls_handshake_sync(). When a synchronous waiter cancels a handshake on timeout or signal, and cancellation races with completion, the waiter can drop a callback-owned reference. This frees the lower transport before xs_tls_handshake_done() completes its callback work. The result is memory corruption in a kernel subsystem reachable through NFS-over-TLS and other RPC-based network services.

Critical Impact
A race condition between TLS handshake cancellation and completion can free the lower transport structure while the callback is still executing, enabling kernel memory corruption over the network.

Affected Products

Linux kernel versions containing the SUNRPC client TLS handshake code path
Distributions shipping kernels with NFS-over-TLS support enabled
Systems using kernel TLS handshake upcall infrastructure for RPC transports

Discovery Timeline

2026-09-11 - CVE-2026-89536 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89536

Vulnerability Analysis

The defect lies in the reference-counting protocol between the synchronous handshake initiator and its asynchronous completion callback. xs_tls_handshake_sync() grants xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the waiter invokes tls_handshake_cancel() and then drops that reference.

The function handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that lost-race scenario, the completion callback may still be executing. Dropping the callback-owned reference in the waiter path can free the lower transport before xs_tls_handshake_done() stores xprt_err or releases its own reference. Any subsequent access from the still-running callback operates on freed memory.

Root Cause

The root cause is an ownership-transfer race in the handshake lifetime model. The waiter and the callback both attempt to release the same reference when cancellation and completion collide. The fix waits for handshake_done signaling from xs_tls_handshake_done() when cancellation loses to completion, allowing the callback to release its own reference. This mirrors the server-side handshake lifetime handling.

Attack Vector

The attack surface is network-facing on hosts using SUNRPC with TLS, such as NFS clients configured for TLS-secured mounts. An attacker positioned to influence handshake timing, force delays, or trigger signal delivery to the client during handshake could provoke the race window. Successful exploitation corrupts kernel memory previously occupied by the lower transport structure, potentially leading to denial of service or further compromise depending on allocator reuse.

No public proof-of-concept or exploit is currently available. Technical details are documented in the upstream commits, including Linux Kernel Commit fb439974 and Linux Kernel Commit 15431820.

Detection Methods for CVE-2026-89536

Indicators of Compromise

Kernel oops or KASAN reports referencing xs_tls_handshake_done, xs_tls_handshake_sync, or tls_handshake_cancel in the call stack
Unexpected NFS-over-TLS mount failures accompanied by kernel warnings about freed transport structures
Slab-use-after-free splats implicating SUNRPC transport allocations following handshake timeouts

Detection Strategies

Enable KASAN on test systems and exercise TLS handshake timeout and signal-interruption paths to surface the race
Monitor kernel ring buffer (dmesg) for SUNRPC and TLS handshake anomalies on hosts running kernels prior to the fix
Correlate NFS client transport resets with handshake cancellation events in system telemetry

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on xs_tls_handshake and handshake_req_cancel stack traces
Track kernel version inventory across the fleet to identify unpatched hosts running SUNRPC TLS workloads
Monitor for abnormal NFS client reconnection storms that could indicate exploitation attempts against the handshake path

How to Mitigate CVE-2026-89536

Immediate Actions Required

Inventory Linux hosts running kernels with SUNRPC TLS support and identify those using NFS-over-TLS or other RPC-with-TLS transports
Apply the upstream stable kernel patches referenced in the fix commits as soon as vendor-supported builds are available
Restrict network exposure of NFS clients to trusted networks until patched kernels are deployed

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the upstream commits: Linux Kernel Commit fb439974, Linux Kernel Commit 15431820, Linux Kernel Commit 1de391e8, Linux Kernel Commit 7fbb6d2a, and Linux Kernel Commit a89dd597. The patch makes the waiter wait for handshake_done signaling when cancellation loses to completion, letting the callback release its reference safely.

Workarounds

Disable NFS-over-TLS mounts and revert to non-TLS RPC transports where operationally acceptable until patches are applied
Avoid signal-driven interruption of mount operations that trigger TLS handshakes on vulnerable kernels
Limit which local users can initiate RPC transport operations that invoke the kernel TLS handshake upcall path

bash

# Verify running kernel version and check for SUNRPC TLS module usage
uname -r
lsmod | grep -E 'sunrpc|handshake|tls'
# Review recent kernel messages for handshake-related warnings
dmesg | grep -iE 'xs_tls_handshake|handshake_req_cancel|sunrpc'