CVE-2026-89536

A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) client TLS (Transport Layer Security) handshake process. A race condition exists where a reference to the lower transport can be prematurely released during handshake cancellation. This can lead to memory corruption, potentially allowing an attacker to cause a denial of service.

Red Hat has evaluated this issue as having an Important severity impact because triggering the race condition can cause kernel memory corruption, leading to a system crash or potential privilege escalation. While upstream designated this vulnerability as remotely exploitable, in Red Hat environments exploitation requires specific timing during local cancellation or timeout of an in-flight RPC-over-TLS handshake. Systems that do not actively establish TLS-encrypted RPC connections (such as NFS over TLS) are not exposed to this vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.