7.8

CVE-2026-89545

sunrpc: defer rq_argp and rq_resp free until after RCU grace period

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: defer rq_argp and rq_resp free until after RCU grace period

svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously
via kfree(), but defers the rqstp struct free via kfree_rcu().  After
svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is
a window where RCU readers that started before list_del_rcu() can still
traverse the thread list and find the rqstp.  These readers (e.g.
nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has
already been freed — a use-after-free.

Fix this by moving the kfree of rq_argp and rq_resp into an explicit
call_rcu() callback alongside the struct free.  Resources not accessed
by RCU readers (bvec, buffer pages, scratch folio, auth_data) remain
synchronously freed.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 812443865c5fc255363d4a684a62c086af1addca
Version < 0ea49d69aa806008b2424c8cf21cf746b9963967
Status affected
Version 812443865c5fc255363d4a684a62c086af1addca
Version < 08bc49e0541260bf294962cf889a32a2d2713ad6
Status affected
Version 812443865c5fc255363d4a684a62c086af1addca
Version < e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090
Status affected
Version 812443865c5fc255363d4a684a62c086af1addca
Version < c479bde671cbe2f9e152834a8b0eb7c3c295bbaf
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.19
Status affected
Version 0
Version < 3.19
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.052
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6
https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090
https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf
https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967