CVE-2026-89536

A race condition in the Linux kernel's SUNRPC client TLS handshake path can cause a use-after-free: when a synchronous handshake (xs_tls_handshake_sync) is aborted by a timeout or signal at the same moment the TLS handshake completes, the cancelling waiter drops a lower-transport reference that is still owned by the in-flight completion callback, freeing the transport while xs_tls_handshake_done() is still using it. The bug is triggered on systems using kernel RPC-with-TLS — for example NFS mounts negotiated with the xprtsec=tls option — when an aborted handshake loses the race against handshake completion. Successful exploitation corrupts kernel memory via a use-after-free, rated CVSS 9.8 with high confidentiality, integrity, and availability impact, which in practice spans kernel crashes (denial of service) up to potential privilege escalation, with an attacker realistically needing the ability to influence handshake timing (e.g., a hostile or degraded network path) against a TLS-enabled RPC/NFS client. Affected systems are any Linux kernels carrying the vulnerable SUNRPC client TLS handshake code and configurations that actually enable RPC-with-TLS. No public proof of concept exists, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Apply kernel updates containing the upstream SUNRPC fix, in which the timeout/signal waiter now waits for handshake_done when cancellation loses the race so the completion callback releases its own reference. Until patched, avoid or restrict xprtsec=tls/tls NFS mounts and other RPC-with-TLS client usage. On TLS-enabled NFS clients, monitor logs for kernel oopses, splats, or slab corruption originating in the xs_tls_handshake paths.