CVE-2026-89545

The Linux kernel's sunrpc subsystem frees the per-request buffers rq_argp and rq_resp synchronously in svc_rqst_free(), while deferring the containing svc_rqst struct to kfree_rcu(), leaving a window in which RCU readers can still traverse the thread list and dereference an already-freed pointer. The flaw is triggered when an nfsd thread exits via svc_exit_thread() and a concurrent reader such as nfsd_nl_rpc_status_get_dumpit() (the NFSD netlink RPC-status dump) accesses rqstp->rq_argp, producing a use-after-free. Exploitation is a local, low-privilege attack (CVSS 3.1: 7.8) that can impact confidentiality, integrity, and availability at high levels, consistent with kernel memory corruption usable for privilege escalation or a system crash. Any host running a kernel with the vulnerable sunrpc/NFSD code path — principally Linux systems running NFS service — is affected; the source data does not enumerate specific affected or fixed kernel versions. No public proof of concept is known and the issue does not appear in the CISA KEV catalog.

What to do: Apply your distribution's kernel update containing the sunrpc fix that moves the kfree of rq_argp and rq_resp into a call_rcu() callback; fixed version numbers vary by vendor, so track distro advisories referencing CVE-2026-89545. Until patched, restrict local untrusted accounts and access to the NFSD netlink RPC-status interface, and watch kernel logs for OOPS/BUG reports in sunrpc/nfsd as a sign of attempted triggering.