HIGH Introduced in 3.4
sunrpc CacheCleaner UAF
CVE-2026-89548
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.2HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.
02KernelScan AI Analysis
Risk summary
An unprivileged local user (or a container tenant) can trigger a use-after-free in the SUNRPC cache subsystem by creating and destroying a network namespace, racing the global cache cleanup worker against the teardown path. The freed cache_detail is accessed by the cleanup worker, which dereferences a function pointer from freed slab memory — leading to potential kernel code execution, container escape, or denial of service. Any system with user namespaces enabled and the SUNRPC module loaded is at risk.
Vulnerability analysis
A background cleanup task that maintains SUNRPC caches is not reliably stopped when a cache is destroyed during network namespace teardown, because a check meant to skip cancellation never succeeds while the initial namespace still has caches registered. The cleanup task can therefore access a freed cache object after the teardown path releases its memory, including dereferencing a function pointer from freed slab. The fix removes the guard so the background task is always stopped before any cache object is freed, then restarted if other caches remain active. An unprivileged local user can trigger this by creating and destroying a network namespace (via user namespaces if enabled), and the resulting kernel memory corruption can be exploited for container escape or privilege escalation.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.4 | 5.10.270 | dec787a15c96 |
| 5.15 | 3.4 | 5.15.221 | 5eea874a6962 |
| 6.1 | 3.4 | 6.1.188 | cf239de7fdcc |
| 6.12 | 3.4 | 6.12.109 | 9d44836f60c8 |
| 6.18 | 3.4 | 6.18.50 | 2e861ce2aaa4 |
| 6.6 | 3.4 | 6.6.157 | 6d74ecc2be12 |
| 7.2 | 3.4 | 7.2.4 | 3d60fdf95114 |
| mainline | 3.4 | 7.3 | f42d0fda0c67 |
| cip/5.10 | 3.4 | 5.10.271-cip78 | dec787a15c96 |
| cip/6.1 | 3.4 | 6.1.189-cip61 | cf239de7fdcc |
| cip/6.1-rt | 3.4 | 6.1.189-cip61-rt32 | cf239de7fdcc |
| cip/6.12 | 3.4 | 6.12.111-cip32 | 9d44836f60c8 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |