CVE-2026-89548: Linux Kernel SUNRPC Use-After-Free Vulnerability

CVE-2026-89548 Overview

CVE-2026-89548 is a use-after-free vulnerability in the Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem. The flaw resides in sunrpc_destroy_cache_detail(), which conditionally cancels the global cache_cleaner delayed work only when cache_list is empty. During per-network-namespace teardown, the list is never empty because init_net caches remain registered, so the cancellation never executes. The kernel then frees the cache_detail while cache_clean() may still hold a dangling pointer to it, producing a use-after-free.

Critical Impact
A local, low-privileged user triggering namespace teardown can cause kernel memory corruption, leading to denial of service or local privilege escalation through function pointer dereference on freed slab memory.

Affected Products

Linux kernel (SUNRPC subsystem) — multiple stable branches referenced by upstream commits
Distributions shipping vulnerable kernel versions prior to the backported fixes
Systems using NFS, RPC, or per-netns cache detail teardown paths

Discovery Timeline

2026-09-11 - CVE-2026-89548 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89548

Vulnerability Analysis

The SUNRPC caching layer uses a global cache_cleaner delayed work item to periodically prune expired entries across all registered cache_detail structures. When a network namespace is torn down, sunrpc_destroy_cache_detail() unlinks the per-netns cache before freeing it via cache_destroy_net().

The defect is a logic error in the cleanup guard: the delayed work cancellation is only invoked when the global cache_list becomes empty. Because init_net retains its own registered caches for the lifetime of the system, cache_list is effectively never empty during per-netns shutdown. The cancel_delayed_work_sync() call is skipped, and a concurrent cache_clean() may still be operating on the cache_detail being freed.

Once freed, cache_dequeue() acquires cd->queue_lock on reclaimed slab memory, and cache_put() dereferences cd->cache_put as a function pointer sourced from that freed memory. This yields a classic use-after-free with function pointer control primitives.

Root Cause

The root cause is an incorrect conditional around cancel_delayed_work_sync(). The list_empty() guard assumes the global work item is only needed while caches exist, but it fails to account for in-flight work already targeting the specific cache_detail being destroyed. This is a race between namespace teardown and the periodic cleaner, classified as a use-after-free [CWE-416].

Attack Vector

Exploitation requires local access with the ability to create and destroy network namespaces or trigger SUNRPC cache teardown paths. A local attacker can race namespace destruction against cache_clean() execution to force dereference of freed memory. Because the freed slab contains a function pointer that is subsequently invoked, an attacker who controls slab reuse content can redirect kernel execution, enabling privilege escalation from an unprivileged context. No user interaction and no network exposure are required.

See the upstream fix at kernel.org commit 5eea874a for the corrected teardown sequence.

Detection Methods for CVE-2026-89548

Indicators of Compromise

Kernel oops or panic messages referencing cache_dequeue, cache_put, or cache_clean in SUNRPC call stacks
KASAN (Kernel Address Sanitizer) reports of use-after-free within net/sunrpc/cache.c
Unexpected process crashes or namespace teardown failures on hosts running NFS or RPC services
Slab corruption warnings correlated with rapid network namespace churn

Detection Strategies

Enable KASAN on test kernels to surface the exact free/use race in sunrpc_destroy_cache_detail()
Monitor dmesg and journald for BUG: KASAN: use-after-free or general protection faults originating in SUNRPC symbols
Audit workloads that programmatically create and tear down network namespaces at high frequency

Monitoring Recommendations

Collect kernel crash dumps centrally and alert on stack traces containing cache_dequeue or cache_put
Track unshare(CLONE_NEWNET) and container lifecycle events on multi-tenant hosts
Correlate NFS client and server activity with namespace destruction events for anomaly detection

How to Mitigate CVE-2026-89548

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable tree that remove the list_empty guard around cancel_delayed_work_sync()
Update distribution kernels to the fixed release published by your vendor and reboot affected hosts
Restrict unprivileged access to unshare and network namespace creation using sysctl kernel.unprivileged_userns_clone=0 where feasible

Patch Information

The fix drops the list_empty guard so cancel_delayed_work_sync() always runs during sunrpc_destroy_cache_detail(), ensuring any in-flight cache_clean() completes before the cache_detail is freed. The cleaner is re-armed afterwards if other caches remain registered. Backports are available across multiple stable branches, including commit 2e861ce2, commit 3d60fdf9, commit 6d74ecc2, commit 9d44836f, commit cf239de7, commit dec787a1, and commit f42d0fda.

Workarounds

Disable unprivileged user namespace creation to reduce local attack surface on shared systems
Limit container runtime access on multi-tenant hosts until kernels are patched
Constrain NFS and RPC services to trusted namespaces where namespace teardown is infrequent

bash

# Reduce local attack surface on unpatched hosts
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-89548.conf

# Verify running kernel against distribution advisory
uname -r