CVE-2026-89540 Linux kernel CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using the sunrpc module, should assess exposure and prioritize remediation. System administrators and security teams should verify kernel versions and apply patches or updates as needed.

Why it matters

A race condition vulnerability in the Linux kernel's sunrpc module allows a local attacker to potentially lock an uninitialized mutex, leading to a denial-of-service or other unspecified impacts. Defenders should assess exposure and prioritize remediation for systems running the affected kernel versions.

• Denial-of-service due to mutex lock
• Potential for unspecified impacts due to uninitialized mutex

Technical summary

The create_use_gss_proxy_proc_entry function publishes a proc entry before initializing the gssp_lock mutex, allowing a local attacker to potentially lock an uninitialized mutex. This vulnerability in the Linux kernel's sunrpc module can lead to a denial-of-service or other unspecified impacts. The issue arises from a race condition between the create_use_gss_proxy_proc_entry function and the init_gssp_clnt function. Defenders should assess exposure and prioritize remediation for systems running affected kernel versions.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure and prioritize remediation for systems running the affected kernel versions
• Verify kernel versions and apply patches or updates as needed
• Monitor system logs for potential denial-of-service or other impacts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the Linux kernel source code. The CVE record and NVD entry provide additional context. However, the corpus does not establish versions, exploitation, impact, or remediation, so these points require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.