CVE-2026-89545

A flaw was found in the Linux kernel. This vulnerability exists within the sunrpc component, where memory associated with rq_argp and rq_resp is freed prematurely. Specifically, the svc_rqst_free() function frees these structures synchronously, while the main request structure (rqstp) is freed later via kfree_rcu(). This timing issue creates a window where RCU (Read-Copy-Update) readers can still access the already freed rq_argp and rq_resp pointers, leading to a use-after-free condition. This memory corruption can result in system instability or potentially lead to further exploitation.

This vulnerability is rated as an Important severity flaw because an authenticated local attacker could trigger a use-after-free condition, leading to kernel memory corruption and potential local privilege escalation. Within SunRPC service thread teardown, request and response buffers are deallocated before concurrent readers finish accessing the associated data structures. While triggering the synchronization race requires precise timing against active in-kernel RPC services, successful exploitation compromises the security integrity of the host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.