CVE-2026-89543: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.

Affected products

Linux: from 6.1.64 before 6.1.191; from 6.6.3 before 6.6.160; from 4.19.318 before 4.20; from 5.4.280 before 5.5; from 5.10.202 before 5.11; from 5.15.140 before 5.16 — fixed in 6.1.191, 6.6.160, 4.20, 5.5, 5.11, 5.16

How to fix

Upgrade to a fixed version: Linux 6.1.191, 6.6.160, 4.20, 5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89543 or the next vulnerability affects your stack