{"id":"AZL-100283","summary":"CVE-2026-89543 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir\n\nNormal client creation goes through rpc_setup_pipedir(), which records\nclnt-\u003epipefs_sb, but the mount-event path in __rpc_clnt_handle_event()\ncalls rpc_setup_pipedir_sb() directly and never refreshes that field.\nThe umount path also removes the directory without clearing\nclnt-\u003epipefs_sb.\n\nAfter a late pipefs mount or any remount, rpc_clnt_remove_pipedir()\ncompares the current superblock against a stale pipefs_sb pointer and\nskips cleanup, leaving pipefs dentries whose inode private data still\npoints at a freed rpc_clnt, leading to a potential use-after-free during\nsubsequent rpc_info_open() or rpc_show_info() calls.\n\nFix this by properly updating clnt-\u003epipefs_sb upon mount events and\nclearing it during unmount or failure paths.","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:37Z","upstream":["CVE-2026-89543"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89543"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100283.json"}}],"schema_version":"1.9.0"}