CVE-2026-89543: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89543 Overview

CVE-2026-89543 is a use-after-free vulnerability in the Linux kernel's sunrpc subsystem. The flaw resides in __rpc_clnt_handle_event() and __rpc_clnt_remove_pipedir(), which mishandle the clnt->pipefs_sb superblock pointer during pipefs mount and unmount events. Stale pointer state causes cleanup to be skipped, leaving pipefs dentries whose inode private data references a freed rpc_clnt structure. Subsequent calls to rpc_info_open() or rpc_show_info() can dereference the freed object, resulting in a use-after-free condition.

Critical Impact
A local actor with access to pipefs after a late mount or remount can trigger a kernel use-after-free, potentially leading to memory corruption, information disclosure, or privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable sunrpc pipefs handling logic prior to the referenced upstream fixes
Distributions shipping the affected sunrpc module without the backported patches
Systems where NFS clients rely on pipefs mount and remount workflows

Discovery Timeline

2026-09-11 - CVE-2026-89543 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89543

Vulnerability Analysis

The sunrpc subsystem tracks the pipefs superblock through the clnt->pipefs_sb field on each rpc_clnt instance. Normal client creation flows through rpc_setup_pipedir(), which records this pointer correctly. The mount-event path takes a different route: __rpc_clnt_handle_event() invokes rpc_setup_pipedir_sb() directly and never refreshes clnt->pipefs_sb.

The unmount path exhibits a parallel defect. It removes the pipefs directory without clearing clnt->pipefs_sb, leaving a dangling reference to a superblock that no longer applies. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against the stale pointer, determines they do not match, and skips cleanup. Pipefs dentries persist with inode private data pointing at freed rpc_clnt memory.

Root Cause

The root cause is inconsistent lifecycle management of the clnt->pipefs_sb field across pipefs mount and unmount code paths. The field is written during initial setup but not synchronized during event-driven mount transitions, producing a stale pointer that defeats subsequent cleanup logic [CWE-416].

Attack Vector

An attacker with local access capable of triggering pipefs mount or remount operations, followed by reads of /proc-style RPC info files, can drive the kernel into dereferencing freed memory. The vulnerability manifests during rpc_info_open() or rpc_show_info() calls that follow the missed cleanup. Refer to the upstream commits 932a8cf, cdf7a23, and e769fcd for the corrective changes.

Detection Methods for CVE-2026-89543

Indicators of Compromise

Kernel oops or panic messages referencing rpc_info_open, rpc_show_info, or sunrpc pipefs dentries
KASAN reports flagging use-after-free access within the sunrpc module on rpc_clnt allocations
Unexpected process termination or kernel task hangs following NFS client remount activity

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to surface use-after-free access on rpc_clnt structures
Audit kernel package versions across the fleet and flag hosts running sunrpc builds that lack the referenced upstream commits
Correlate NFS mount and remount events with subsequent reads of RPC info files under /sys/kernel/debug or /proc

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on BUG:, KASAN:, or general protection fault entries citing sunrpc
Track systems that perform late pipefs mounts or repeated NFS client remounts, particularly on multi-tenant hosts
Monitor kernel crash telemetry from tools such as kdump and abrt for repeat faults tied to RPC client operations

How to Mitigate CVE-2026-89543

Immediate Actions Required

Apply the vendor kernel update that incorporates commits 932a8cf, cdf7a23, and e769fcd
Reboot affected systems after patch installation to load the corrected sunrpc code path
Restrict local user access on hosts where kernel patching must be deferred, and audit who can initiate NFS mount operations

Patch Information

The upstream fix updates clnt->pipefs_sb on mount events and clears the field during unmount and failure paths, ensuring rpc_clnt_remove_pipedir() performs cleanup against the correct superblock. Patched kernels are available through the mainline stable trees referenced in the kernel.org commit history. Distribution maintainers are expected to backport the fix to their supported kernel branches.

Workarounds

Avoid late pipefs mount and remount sequences on kernels lacking the fix by mounting pipefs during initial NFS client setup
Limit access to RPC info interfaces such as rpc_info_open consumers to trusted administrative accounts
Where feasible, unload the sunrpc module on hosts that do not require NFS client functionality until patches are applied

bash

# Verify running kernel and confirm the sunrpc fix is present
uname -r
grep -E 'sunrpc|rpc_clnt' /proc/kallsyms | head
# Restrict mount capability for non-root users
sudo setcap -r /bin/mount 2>/dev/null || true