CVE-2026-89540 Overview
CVE-2026-89540 is a race condition vulnerability in the Linux kernel's sunrpc subsystem. The flaw resides in create_use_gss_proxy_proc_entry(), which publishes the /proc/net/rpc/use-gss-proxy entry via proc_create_data() before init_gssp_clnt() runs mutex_init() on sn->gssp_lock. Once the dentry is linked under proc_subdir_lock, userspace can reach it immediately. A local writer that hits the window can operate on a zero-initialized mutex, corrupting kernel state.
Critical Impact
A local attacker with write access to /proc/net/rpc/use-gss-proxy can trigger concurrent execution in set_gssp_clnt(), leaking RPC client objects and potentially destabilizing the kernel with debug builds tripping a "lock used without init" splat.
Affected Products
- Linux kernel sunrpc subsystem with auth_rpcgss module support
- Multiple stable kernel branches referenced in the upstream fix commits
- Systems with CONFIG_DEBUG_MUTEXES enabled are most likely to crash on exploitation attempts
Discovery Timeline
- 2026-09-11 - CVE-2026-89540 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89540
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the sunrpc module's proc-entry registration path. create_use_gss_proxy_proc_entry() calls proc_create_data("use-gss-proxy", ...), publishing the dentry to userspace before init_gssp_clnt() initializes sn->gssp_lock. Because register_pernet_subsys() runs in preemptible context under pernet_ops_rwsem, the registering thread may be preempted between these two statements. During that window, another task opening the freshly published file drives set_gssp_clnt() into mutex_lock() on an uninitialized struct mutex.
The window widens on auth_rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. Two concurrent writers can enter set_gssp_clnt(), shut down the first writer's clnt while it is still in use, and leak the loser's clnt.
Root Cause
The root cause is initialization ordering: the proc entry is made reachable from userspace before its associated synchronization primitive is initialized. On the fast path, mutex_lock() uses CMPXCHG(owner, 0, current), which succeeds against a zero-filled mutex, defeating mutual exclusion entirely.
Attack Vector
Exploitation requires local access with sufficient privileges to write to /proc/net/rpc/use-gss-proxy. An attacker races a write() against the module load or per-netns registration path. Winning the race lets the writer operate on kernel state without the intended lock guarantees, producing a client leak and potential use-after-free of the RPC client structure.
Because no verified proof-of-concept code has been published, technical readers should consult the upstream commits for the exact patch semantics.
Detection Methods for CVE-2026-89540
Indicators of Compromise
- Kernel log entries containing "lock used without init" splats referencing gssp_lock on CONFIG_DEBUG_MUTEXES kernels
- Unexplained sunrpc client teardown messages coincident with auth_rpcgss module load
- Kernel memory growth consistent with leaked rpc_clnt allocations under the sunrpc slab
Detection Strategies
- Monitor dmesg and journalctl -k for mutex debug warnings originating in net/sunrpc/auth_gss/
- Audit processes writing to /proc/net/rpc/use-gss-proxy, particularly non-root or short-lived writers during boot or module load
- Use eBPF tracing on set_gssp_clnt and gssp_rpc_create to observe concurrent entries
Monitoring Recommendations
- Collect kernel telemetry from all Linux hosts running NFS with GSS proxy enabled
- Alert on auth_rpcgss module load events followed by writes to the use-gss-proxy proc entry within a short window
- Track slab statistics for rpc_clnt and related objects to identify slow leaks
How to Mitigate CVE-2026-89540
Immediate Actions Required
- Apply the upstream kernel patches referenced in the kernel.org commits for the affected stable branches
- Restrict write access to /proc/net/rpc/use-gss-proxy to trusted administrators only
- Where GSS proxy is not required, avoid loading the auth_rpcgss module
Patch Information
The upstream fix initializes sn->gssp_lock in sunrpc_init_net() so its lifetime matches the sunrpc_net it lives in. Because sn->gssp_clnt is already NULL from the kzalloc that backs net_generic storage, the lazy init_gssp_clnt() helper is removed along with its prototype and the call in create_use_gss_proxy_proc_entry(). Since sunrpc.ko is a build-time dependency of auth_rpcgss.ko, sunrpc_init_net() always runs on every netns before any auth_gss pernet init publishes the proc entry. Patches are available in the following commits: 159a4fa, 3f01957, 5ce1ed6, 7f5bcdc, 89c8e07, b3526ae, edeefb1, and f15b875.
Workarounds
- Blacklist the auth_rpcgss module on systems that do not require GSS-based RPC authentication
- Tighten permissions on /proc/net/rpc/use-gss-proxy to prevent unprivileged writes
- Defer auth_rpcgss module load until after boot completes to shrink the exploitable window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
