CVE-2026-89543

A flaw was found in the kernel's sunrpc component. A use-after-free vulnerability can occur due to improper handling of clnt->pipefs_sb pointers during mount and unmount events. This can lead to stale pointers, which, when accessed, may result in a system crash (Denial of Service).

A use after free can occur in the SUNRPC pipefs lifecycle because clnt pipefs_sb may become stale across mount, unmount, or remount events. If cleanup is skipped, pipefs dentries can remain with inode private data that still references a freed rpc_clnt object, and later rpc_info_open or rpc_show_info access can dereference that freed object. For the CVSS the PR:L is used for the paranoid score because some deployments may expose the relevant mount namespace or service lifecycle control to a local user, container root, or service account rather than only to full host root. The issue is not directly network reachable and is triggered through local rpc_pipefs and SUNRPC client lifecycle paths. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality, integrity, and availability impact due to a kernel use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.