CVE-2026-89540

A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the gssp_lock mutex is not initialized before its associated /proc/net/rpc/use-gss-proxy entry is published. This allows a local attacker to trigger a scenario where multiple writers can concurrently access the set_gssp_clnt() function, leading to a denial of service for the first writer's client and a resource leak.

A race in SUNRPC gssproxy setup can expose /proc/net/rpc/use-gss-proxy before sn gssp_lock is initialized. A local writer that reaches the proc file in this narrow window can enter set_gssp_clnt() and lock a zero initialized mutex. On debug kernels this can trigger a lock used without init warning. On production kernels the mutex fast path may treat the zeroed object as unlocked, allowing concurrent set_gssp_clnt() execution and a possible shutdown of an rpc client while it is still in use. For the CVSS the PR:L is used because reliable triggering can be possible from a local user or service context that can access the per net proc entry, especially with namespace based setups, rather than requiring full host root in every deployment. The issue is not directly network reachable. Impact is at least local denial of service and in the paranoid case may include confidentiality or integrity impact due to a plausible use-after-free candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.