CVE-2026-90235

A flaw was found in the xprtsock component of the Linux kernel's sunrpc implementation. This concurrency vulnerability arises from improper synchronization when updating and reading shared socket callback pointers. As a result, a processor might use an outdated reference to a callback function after the live callback fields have been restored. This can lead to the invocation of incorrect or outdated callback functions, potentially causing unexpected system behavior or instability.

SUNRPC xprtsock updates shared socket callback pointers for sk_data_ready and sk_write_space on live AF_LOCAL UDP and TCP sockets without READ_ONCE() and WRITE_ONCE() visibility annotations. Generic socket and protocol paths may read or invoke these callbacks concurrently, so a stale callback snapshot can call xs_data_ready() or xs_udp_write_space() after the socket has been restored to lower level handlers during teardown. This is a race condition and UAF candidate because the stale callback may operate on SUNRPC transport state after ownership is changing or gone, causing at least kernel crash or service disruption. For the CVSS the PR:N is selected because a malicious RPC peer or MITM does not need local privileges on the victim once the client uses the affected SUNRPC transport. The issue is network reachable in NFS or SUNRPC client deployments, but practical exploitation usually requires timing the connection teardown or reconnect path and access as the contacted server or network path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.