CVE-2026-89545: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89545 Overview

CVE-2026-89545 is a use-after-free vulnerability in the Linux kernel's sunrpc subsystem. The flaw resides in svc_rqst_free(), which frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree() while deferring the containing rqstp structure through kfree_rcu(). This asymmetry creates a window where concurrent RCU readers traversing the server thread list can dereference already-freed argument and response buffers. The vulnerability affects local, authenticated attackers on systems running NFS server functionality and can lead to memory corruption or privilege escalation.

Critical Impact
Local attackers with low privileges can trigger a use-after-free in kernel memory through NFS server thread enumeration, potentially leading to kernel memory corruption, information disclosure, or privilege escalation to root.

Affected Products

Linux kernel sunrpc subsystem
NFS server (nfsd) implementations relying on svc_rqst lifecycle management
Distributions shipping affected kernel versions prior to the patched commits

Discovery Timeline

2026-09-11 - CVE-2026-89545 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89545

Vulnerability Analysis

The vulnerability originates in the Linux kernel's Sun RPC (sunrpc) service request lifecycle. When a service thread exits, svc_exit_thread() calls list_del_rcu() to remove the rqstp entry from the thread list, then invokes svc_rqst_free() to release associated resources. Inside svc_rqst_free(), the code path frees rq_argp and rq_resp synchronously with kfree() but defers the rqstp structure release to kfree_rcu().

Because kfree_rcu() waits for an RCU grace period before releasing the outer structure, RCU readers that began their traversal before list_del_rcu() can still legitimately observe the rqstp pointer. When these readers, such as nfsd_nl_rpc_status_get_dumpit(), dereference rqstp->rq_argp to inspect in-flight RPC state, they access memory that has already been returned to the slab allocator.

Root Cause

The root cause is inconsistent memory reclamation semantics between the rqstp container and its rq_argp and rq_resp fields. RCU protects readers only when all fields they may access outlive the grace period. Freeing sub-objects synchronously while deferring the parent violates the RCU contract and produces a classic use-after-free condition.

Attack Vector

Exploitation requires local access with low privileges on a host running an NFS server. An attacker races the exit of an NFS service thread against a netlink query that dumps RPC status via nfsd_nl_rpc_status_get_dumpit(). Successful timing causes the kernel to read freed slab memory, which an attacker may have reallocated with attacker-controlled content. This primitive can be leveraged for kernel information disclosure or, when combined with heap grooming, for arbitrary kernel memory write and privilege escalation.

No verified public exploit code is available. The upstream fix moves the kfree of rq_argp and rq_resp into an explicit call_rcu() callback alongside the structure free, ensuring all RCU-protected fields persist through the grace period. Resources not accessed by RCU readers, including bvec, buffer pages, scratch folio, and auth_data, remain freed synchronously.

Detection Methods for CVE-2026-89545

Indicators of Compromise

Kernel oops or panic messages referencing sunrpc, svc_rqst_free, or nfsd_nl_rpc_status_get_dumpit in dmesg output.
KASAN use-after-free reports involving rq_argp or rq_resp allocations on kernels with KASAN enabled.
Unexpected NFS server thread crashes or restarts coinciding with netlink queries against the nfsd family.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface use-after-free access patterns in sunrpc code paths.
Audit kernel version strings across the fleet and compare against the fixed commits 08bc49e05412, c479bde671cb, and e0c5693d3f9a.
Monitor for unprivileged local processes invoking nfsd netlink dump operations, which is atypical for standard workloads.

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces containing svc_rqst_free or svc_exit_thread.
Track NFS server thread pool churn using existing observability tooling to detect anomalous thread termination bursts.
Baseline netlink socket activity from non-root users and flag deviations targeting the nfsd generic netlink family.

How to Mitigate CVE-2026-89545

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 08bc49e05412, c479bde671cb, and e0c5693d3f9a as soon as vendor packages become available.
Prioritize patching on hosts that expose NFS server functionality or run untrusted local workloads.
Restrict local shell access on NFS servers to trusted administrative accounts until patches are deployed.

Patch Information

The fix is available in the mainline Linux kernel through the commits Kernel Git Commit Update, Kernel Git Commit Fix, and Kernel Git Commit Enhancement. The patch moves rq_argp and rq_resp deallocation into a call_rcu() callback so that all RCU-visible fields are released only after the grace period completes.

Workarounds

Disable the NFS server (nfsd) service on hosts where it is not required by stopping the service and blacklisting the nfsd kernel module.
Restrict access to the nfsd generic netlink family by limiting CAP_NET_ADMIN and CAP_SYS_ADMIN capabilities to trusted service accounts.
Reduce local attack surface by removing shell access for untrusted users on hosts running NFS server workloads.

bash

# Configuration example: disable nfsd where not required
sudo systemctl stop nfs-server
sudo systemctl disable nfs-server
echo 'blacklist nfsd' | sudo tee /etc/modprobe.d/blacklist-nfsd.conf
sudo depmod -a