CVE-2026-89784 Overview
CVE-2026-89784 is a NULL pointer dereference vulnerability in the Linux kernel's SUNRPC subsystem. The flaw resides in rpcb_register_inet4() and rpcb_register_inet6(), which store the return value of rpc_sockaddr2uaddr() into map->r_addr without validating it against NULL. When the internal kstrdup() call inside rpc_sockaddr2uaddr() fails under memory pressure, the unchecked NULL propagates into the synchronous RPCBPROC_SET encode path. The kernel then dereferences the NULL pointer inside strlen() during encode_rpcb_string(), triggering a general protection fault and kernel oops.
Critical Impact
An in-kernel RPC service registration under memory pressure can panic the kernel, resulting in a local denial of service on affected Linux systems running nfsd, lockd, or nfs-callback.
Affected Products
- Linux kernel (SUNRPC subsystem, net/sunrpc/rpcb_clnt.c)
- Kernel builds using in-kernel RPC services such as nfsd, lockd, and nfs-callback
- Confirmed reproducer on Linux kernel v6.12 under failslab and KASAN
Discovery Timeline
- 2026-09-16 - CVE-2026-89784 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89784
Vulnerability Analysis
The defect lives in the rpcbind client code inside net/sunrpc/rpcb_clnt.c. Both rpcb_register_inet4() and rpcb_register_inet6() call rpc_sockaddr2uaddr() to convert a socket address into a universal address string. The helper returns NULL if its final kstrdup() allocation fails. The register functions store the return value directly into map->r_addr without a NULL check.
The unchecked pointer then flows into rpcb_register_call(), rpc_call_sync(), rpcb_enc_getaddr(), and finally encode_rpcb_string(). The first statement in the encoder is strlen(string), which dereferences the NULL pointer. Under KASAN the fault surfaces as a general protection fault on the shadow of address zero (0xdffffc0000000000), oopsing the kernel.
Root Cause
The root cause is a missing return-value check on a fallible allocation path [CWE-476: NULL Pointer Dereference]. The asynchronous getport path already handles this exact failure mode by returning -ENOMEM, but the two register helpers omit the check. This inconsistency left a code path where a benign allocation failure escalates into a kernel oops.
Attack Vector
The issue is triggered locally when an in-kernel RPC service registers with the local rpcbind daemon under enough memory pressure to fail a small GFP_KERNELkstrdup(). The reachable path passes through svc_register(), svc_setup_socket(), svc_addsock(), and write_ports() in nfsctl_transaction_write(). Exploitation does not require authentication over the network, but it does require conditions that starve the kernel slab allocator during RPC service registration.
The vulnerability is a reliability and availability issue rather than a code-execution primitive. See the upstream fix commit fd22370 for the corrected error handling that returns -ENOMEM before the NULL address reaches the encoder.
Detection Methods for CVE-2026-89784
Indicators of Compromise
- Kernel oops messages referencing strlen, encode_rpcb_string, or rpcb_enc_getaddr in dmesg or /var/log/kern.log.
- General protection fault entries with call traces through rpcb_v4_register and svc_register following NFS or lockd service startup.
- Unexpected restarts of nfsd, lockd, or nfs-callback services correlated with system memory pressure events.
Detection Strategies
- Monitor kernel ring buffer output for oops signatures matching the SUNRPC call trace documented in the advisory.
- Correlate NFS server registration failures with slab allocator failures reported through /proc/slabinfo or vmstat.
- Track kernel version and patch level across the fleet to identify unpatched hosts running NFS or related RPC services.
Monitoring Recommendations
- Forward kernel logs into a centralized log platform and alert on GPF or oops events involving SUNRPC symbols.
- Baseline memory pressure metrics on NFS servers and alert when MemAvailable drops to levels where GFP_KERNEL allocations begin to fail.
- Track uptime and unexpected reboots on hosts exporting NFS shares to identify possible triggered crashes.
How to Mitigate CVE-2026-89784
Immediate Actions Required
- Apply the upstream Linux kernel patch series that adds the missing NULL check to rpcb_register_inet4() and rpcb_register_inet6().
- Prioritize patching hosts that run nfsd, lockd, or nfs-callback, especially systems that experience memory pressure.
- Reboot affected systems after patching to load the corrected kernel image.
Patch Information
The fix mirrors the existing asynchronous getport handling by returning -ENOMEM when rpc_sockaddr2uaddr() returns NULL, before the address is passed to the encoder. Backported fixes are available across multiple stable kernel branches. Reference commits include 04441b7, 12bf3e0, 4a6095d, 4e01022, 5a51c49, cda4aac, eb47628, and fd22370.
Workarounds
- Reduce the likelihood of allocation failure by provisioning adequate memory and swap on NFS servers.
- Disable in-kernel RPC services on hosts that do not require them until patches are applied.
- Restrict administrative access to nfsctl and related interfaces so only trusted operators can trigger RPC service registration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
