Cloudanix VulnDB

CVE-2026-90235

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A hidden timing flaw in the Linux network code could let attackers crash servers or take them over by interfering with how connections are set up and torn down.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel sunrpc xprtsock where plain stores/loads of sk_data_ready and sk_write_space callbacks allow stale function pointers to be invoked concurrently after SUNRPC restores original socket handlers during teardown or buffer size changes.

Why it matters to the business

Linux systems running NFS, RPC, or related network services face elevated risk of kernel instability, crashes, or remote code execution, potentially disrupting critical infrastructure and requiring urgent patching across server fleets.

How an attack unfolds

An attacker establishes connections that trigger SUNRPC socket takeover on AF_LOCAL/UDP/TCP, then races teardown or buffer operations so another CPU invokes xs_data_ready or xs_udp_write_space after callbacks have been restored, leveraging the missing READ_ONCE/WRITE_ONCE visibility to reach unintended code paths.

How to fix it

Apply the upstream kernel patch that annotates xs_local_finish_connecting, xs_udp_finish_connecting, xs_tcp_finish_connecting, xs_restore_old_callbacks with WRITE_ONCE and xs_udp_do_set_buffer_size with READ_ONCE; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Inspect kernel source for presence of READ_ONCE/WRITE_ONCE annotations on the listed callback stores and loads; boot patched kernels and exercise SUNRPC socket connect/teardown sequences under concurrency to confirm absence of stale callback behavior.

Typical attack path

  1. Locate Linux kernel hosts exposing RPC/NFS services
  2. Initiate socket connections to engage xprtsock connecting paths
  3. Trigger concurrent teardown or xs_udp_do_set_buffer_size while callbacks are replaced
  4. Force invocation of stale callback snapshots to induce memory corruption or control-flow hijack

How to detect it

Review kernel logs for sunrpc or xprtsock oops/panic traces referencing callback pointers; correlate with unusual UDP/TCP connection patterns to RPC ports; inspect for post-teardown callback invocations in crash dumps.

What your security team should do

  • Immediately schedule kernel updates for all systems using sunrpc
  • Prioritize production NFS/RPC servers given CVSS 9.8
  • Monitor kernel update channels for backports to supported LTS branches
  • Review socket-related kernel crash reports for signs of attempted exploitation

The record

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and restores sk->sk_data_ready and sk->sk_write_space on live sockets with plain stores, and xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain load. These callback pointers are shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract that the validated 4022 family applied elsewhere. When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot can still invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have already been restored to the lower-socket handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent sk_state_change and sk_error_report handling unchanged.

Affected packages

Ecosystem Package Introduced Fixed