CVE-2026-89543

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Normal client creation goes through rpc_setup_pipedir(), which records

clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event()

calls rpc_setup_pipedir_sb() directly and never refreshes that field.

The umount path also removes the directory without clearing

clnt->pipefs_sb.

After a late pipefs mount or any remount, rpc_clnt_remove_pipedir()

compares the current superblock against a stale pipefs_sb pointer and

skips cleanup, leaving pipefs dentries whose inode private data still

points at a freed rpc_clnt, leading to a potential use-after-free during

subsequent rpc_info_open() or rpc_show_info() calls.

Fix this by properly updating clnt->pipefs_sb upon mount events and

clearing it during unmount or failure paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References