CVE-2026-89545

What it actually does

Use-after-free in Linux kernel sunrpc where svc_rqst_free synchronously kfree's rq_argp and rq_resp before the rqstp struct is freed via kfree_rcu, allowing RCU readers traversing the thread list to dereference the already-freed pointers.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, crashes, or privilege escalation, potentially disrupting services and requiring urgent patching across server fleets.

How an attack unfolds

An attacker with local access performs RPC or NFS operations that cause list_del_rcu and svc_rqst_free to run while concurrent RCU readers such as nfsd_nl_rpc_status_get_dumpit still hold references, dereferencing the freed rq_argp and triggering the use-after-free.

How to fix it

Upgrade to a Linux kernel containing the fix that moves rq_argp and rq_resp kfree into an explicit call_rcu callback alongside the rqstp free.

How to confirm the fix worked

Verify the running kernel includes the sunrpc deferral change; inspect dmesg or kernel logs for absence of use-after-free warnings in svc_rqst paths and confirm updated source or package version.

Typical attack path

1. Gain local user access on a vulnerable Linux host
2. Trigger sunrpc thread exit via targeted RPC or NFS workload
3. Race with RCU readers that dereference rq_argp after synchronous free
4. Exploit resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs and dmesg for use-after-free or slab-out-of-bounds warnings referencing sunrpc, svc_rqst_free, or rq_argp; correlate with audit logs showing local RPC or NFS activity preceding crashes.

What your security team should do

• Prioritize kernel updates on all exposed systems within standard change windows
• Enable kernel hardening features such as KASAN or hardened usercopy where available
• Monitor EPSS and exploit maturity; reassess if scores rise
• Restrict untrusted local access on systems running nfsd or sunrpc