CVE-2026-89543
CVE CVE-2026-89543EUVD EUVD-2026-76454Published 2026-09-11T19:44:19.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 1cdb52ffd6600a37bd355d8dce58ecd03e55e618; bfca5fb4e97c46503ddfc582335917b0cc228264 <cdf7a233cb94774b0e7df42d9157077983f5022c; bfca5fb4e97c46503ddfc582335917b0cc228264 <e769fcde3cc73e847b1eb3acd40c04a291cb0c0c; cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a; 6.1.64 <6.2; 7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5; 6.7; 194454afa6aa9d6ed74f0c57127bc8beb27c20df; 17866066b8ac1cc38fb449670bc15dc9fee4b40a; dedf2a0eb9448ae73b270743e6ea9b108189df46; 6.6.3 <6.7; 7749fd2dbef72a52b5c9ffdbf877691950ed4680; patch: 7.3-rc1; bfca5fb4e97c46503ddfc582335917b0cc228264 <932a8cf6abb2b2f8677b79153a823108d8861fe2; 4.19.318 <4.20; 5.10.202 <5.11; patch: 0; patch: 7.2.4; patch: 6.18.50; 6.5.13 <6.6; 5.15.140 <5.16; 5.4.280 <5.5
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.