In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period… (CVE-2026-89545)
A use-after-free vulnerability in the Linux kernel's sunrpc subsystem was resolved by deferring the freeing of rq_argp and rq_resp until after the RCU grace period. The issue occurred because svc_rqst_free() freed these pointers synchronously, while the containing rqstp struct was freed asynchronously via RCU, allowing readers to access freed memory. The fix moves the freeing of rq_argp and rq_resp into an RCU callback to prevent use-after-free conditions.
AI Analysis
Technical Summary
The Linux kernel's sunrpc subsystem had a use-after-free vulnerability (CVE-2026-89545) where svc_rqst_free() freed rq_argp and rq_resp synchronously with kfree(), but the rqstp struct was freed asynchronously via kfree_rcu(). This created a window where RCU readers could still access rqstp and dereference rq_argp, which had already been freed, leading to a use-after-free. The fix defers freeing rq_argp and rq_resp to an explicit call_rcu() callback alongside the struct free, ensuring safe memory reclamation. Other resources not accessed by RCU readers remain synchronously freed.
Potential Impact
This vulnerability could lead to use-after-free conditions in the Linux kernel's sunrpc subsystem, potentially causing kernel crashes or memory corruption if exploited. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented that defers freeing rq_argp and rq_resp until after the RCU grace period via call_rcu(), alongside the asynchronous freeing of the rqstp struct. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period… (CVE-2026-89545)
Description
A use-after-free vulnerability in the Linux kernel's sunrpc subsystem was resolved by deferring the freeing of rq_argp and rq_resp until after the RCU grace period. The issue occurred because svc_rqst_free() freed these pointers synchronously, while the containing rqstp struct was freed asynchronously via RCU, allowing readers to access freed memory. The fix moves the freeing of rq_argp and rq_resp into an RCU callback to prevent use-after-free conditions.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's sunrpc subsystem had a use-after-free vulnerability (CVE-2026-89545) where svc_rqst_free() freed rq_argp and rq_resp synchronously with kfree(), but the rqstp struct was freed asynchronously via kfree_rcu(). This created a window where RCU readers could still access rqstp and dereference rq_argp, which had already been freed, leading to a use-after-free. The fix defers freeing rq_argp and rq_resp to an explicit call_rcu() callback alongside the struct free, ensuring safe memory reclamation. Other resources not accessed by RCU readers remain synchronously freed.
Potential Impact
This vulnerability could lead to use-after-free conditions in the Linux kernel's sunrpc subsystem, potentially causing kernel crashes or memory corruption if exploited. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented that defers freeing rq_argp and rq_resp until after the RCU grace period via call_rcu(), alongside the asynchronous freeing of the rqstp struct. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-43p7-fx92-rp4x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89545"]
Threat ID: 6aa4a01355bf5e2cf5a866c8
Added to database: 09/12/2026, 00:42:59 UTC
Last enriched: 09/12/2026, 01:09:12 UTC
Last updated: 09/12/2026, 01:09:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.