CVE-2026-89548
Description
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.
How to fix
- Linux Linuxdec787a15c96a5665e9ffc61b429a6a4ab26e6b9, 5eea874a696201c31e7c2d7badbfa0d90e9961b5, cf239de7fdcc8336259b01ea4bcf650dadad1040, 6d74ecc2be120a0c300b224b7649fe93c0453714, 9d44836f60c8c29bcdb1471fd9202387c642a890, 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b, 3d60fdf951143d6ef4e352e2f8eb852286701726, f42d0fda0c67695db6bc704b04b7c10240805377 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < dec787a15c96a5665e9ffc61b429a6a4ab26e6b9, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < 5eea874a696201c31e7c2d7badbfa0d90e9961b5, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < cf239de7fdcc8336259b01ea4bcf650dadad1040, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < 6d74ecc2be120a0c300b224b7649fe93c0453714, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < 9d44836f60c8c29bcdb1471fd9202387c642a890, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < 3d60fdf951143d6ef4e352e2f8eb852286701726, 820f9442e711a81749e70c40f149fc54c4ce0ca8 ≤ v < f42d0fda0c67695db6bc704b04b7c10240805377, 3.4 | dec787a15c96a5665e9ffc61b429a6a4ab26e6b9, 5eea874a696201c31e7c2d7badbfa0d90e9961b5, cf239de7fdcc8336259b01ea4bcf650dadad1040, 6d74ecc2be120a0c300b224b7649fe93c0453714, 9d44836f60c8c29bcdb1471fd9202387c642a890, 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b, 3d60fdf951143d6ef4e352e2f8eb852286701726, f42d0fda0c67695db6bc704b04b7c10240805377 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.