{"id":"CVE-2026-89545","summary":"sunrpc: defer rq_argp and rq_resp free until after RCU grace period","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: defer rq_argp and rq_resp free until after RCU grace period\n\nsvc_rqst_free() frees rqstp-\u003erq_argp and rqstp-\u003erq_resp synchronously\nvia kfree(), but defers the rqstp struct free via kfree_rcu().  After\nsvc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is\na window where RCU readers that started before list_del_rcu() can still\ntraverse the thread list and find the rqstp.  These readers (e.g.\nnfsd_nl_rpc_status_get_dumpit()) dereference rqstp-\u003erq_argp, which has\nalready been freed — a use-after-free.\n\nFix this by moving the kfree of rq_argp and rq_resp into an explicit\ncall_rcu() callback alongside the struct free.  Resources not accessed\nby RCU readers (bvec, buffer pages, scratch folio, auth_data) remain\nsynchronously freed.","modified":"2026-09-13T03:46:32.141614207Z","published":"2026-09-11T19:44:21.161Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89545.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89545.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89545"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"812443865c5fc255363d4a684a62c086af1addca"},{"fixed":"08bc49e0541260bf294962cf889a32a2d2713ad6"},{"fixed":"e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090"},{"fixed":"c479bde671cbe2f9e152834a8b0eb7c3c295bbaf"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89545.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89545.json"}}],"schema_version":"1.9.0"}