CVE-2026-89548

SUNRPC: always drain cache_cleaner before destroying a cache_detail

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: always drain cache_cleaner before destroying a cache_detail

sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab.

Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	820f9442e711a81749e70c40f149fc54c4ce0ca8 to before dec787a15c96a5665e9ffc61b429a6a4ab26e6b9Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 5eea874a696201c31e7c2d7badbfa0d90e9961b5Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before cf239de7fdcc8336259b01ea4bcf650dadad1040Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 6d74ecc2be120a0c300b224b7649fe93c0453714Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 9d44836f60c8c29bcdb1471fd9202387c642a890Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 2e861ce2aaa468351a6a47c4cbb4971ebb740c7bAffected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 3d60fdf951143d6ef4e352e2f8eb852286701726Affected 820f9442e711a81749e70c40f149fc54c4ce0ca8 to before f42d0fda0c67695db6bc704b04b7c10240805377Affected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

820f9442e711a81749e70c40f149fc54c4ce0ca8 to before dec787a15c96a5665e9ffc61b429a6a4ab26e6b9Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 5eea874a696201c31e7c2d7badbfa0d90e9961b5Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before cf239de7fdcc8336259b01ea4bcf650dadad1040Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 6d74ecc2be120a0c300b224b7649fe93c0453714Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 9d44836f60c8c29bcdb1471fd9202387c642a890Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 2e861ce2aaa468351a6a47c4cbb4971ebb740c7bAffected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before 3d60fdf951143d6ef4e352e2f8eb852286701726Affected
820f9442e711a81749e70c40f149fc54c4ce0ca8 to before f42d0fda0c67695db6bc704b04b7c10240805377Affected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.