Cloudanix VulnDB

CVE-2026-89543

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux network file system handling could let a local attacker crash servers or potentially run harmful code with elevated privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in sunrpc pipefs handling where stale clnt->pipefs_sb pointers allow rpc_info_open or rpc_show_info to dereference freed rpc_clnt objects after mount or remount events.

Why it matters to the business

Potential kernel crashes, denial of service, or local privilege escalation on Linux systems using RPC-based services such as NFS; low immediate risk given absent KEV listing and flat low EPSS trend.

How an attack unfolds

An attacker with local access triggers a late pipefs mount or remount sequence that leaves stale pipefs_sb references; subsequent rpc_info_open or rpc_show_info calls then access freed memory, enabling use-after-free exploitation.

How to fix it

Apply the upstream kernel patch that updates clnt->pipefs_sb on mount events and clears it on unmount or failure paths; rebuild and reboot with the fixed kernel version once available from the distribution.

How to confirm the fix worked

Confirm the fix by inspecting the patched __rpc_clnt_handle_event and rpc_clnt_remove_pipedir functions for proper pipefs_sb updates, then verify absence of use-after-free warnings in dmesg during mount/remount test sequences.

Typical attack path

  1. Obtain local shell or user context on target Linux host
  2. Trigger rpc client creation followed by delayed pipefs mount or remount operations
  3. Invoke rpc_info_open or rpc_show_info paths while stale pointers remain
  4. Leverage resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free or slab object warnings mentioning rpc_clnt, pipefs_sb, rpc_info_open, or rpc_show_info around mount events; correlate with unusual pipefs activity in audit logs.

What your security team should do

  • Prioritize patching Linux kernel packages on all systems exposing NFS or sunrpc services within standard change windows
  • Monitor upstream stable kernel releases and distribution advisories for the specific sunrpc pipefs fix
  • Restrict unprivileged local access on high-value systems until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.

Affected packages

Ecosystem Package Introduced Fixed