CVE-2026-89548
CVE CVE-2026-89548EUVD EUVD-2026-76459Published 2026-09-11T19:44:23.000ZLast changed 2026-09-14T12:00:51.000ZCVSS 7.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux patch: 6.12.109; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <3d60fdf951143d6ef4e352e2f8eb852286701726; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <2e861ce2aaa468351a6a47c4cbb4971ebb740c7b; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <f42d0fda0c67695db6bc704b04b7c10240805377; patch: 5.10.270; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <cf239de7fdcc8336259b01ea4bcf650dadad1040; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <6d74ecc2be120a0c300b224b7649fe93c0453714; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <dec787a15c96a5665e9ffc61b429a6a4ab26e6b9; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <9d44836f60c8c29bcdb1471fd9202387c642a890; patch: 6.18.50; patch: 7.3-rc1; patch: 6.1.188; patch: 0; patch: 6.6.157; 820f9442e711a81749e70c40f149fc54c4ce0ca8 <5eea874a696201c31e7c2d7badbfa0d90e9961b5; patch: 7.2.4; patch: 5.15.221; 3.4
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.