CVE-2026-89545 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should review the CVE record and NVD entry for details on the vulnerability. They should also review and apply the Linux kernel patch to fix the use-after-free vulnerability, update the Linux kernel to the latest version, and monitor Linux kernel updates and apply patches promptly to prevent potential use-after-free vulnerability.

Why it matters

A use-after-free vulnerability was found in the Linux kernel's sunrpc module. The fix moves the kfree of rq_argp and rq_resp into an explicit call_rcu() callback alongside the struct free. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should review and apply the patch promptly to prevent potential use-after-free vulnerability.

• Potential use-after-free vulnerability in Linux kernel
• Need to review and apply Linux kernel patches promptly
• Potential impact on Linux-based systems

Technical summary

The Linux kernel's sunrpc module has a use-after-free vulnerability. svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously, but defers the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can still traverse the thread list and find the rqstp, leading to a potential use-after-free. The fix moves the kfree of rq_argp and rq_resp into an explicit call_rcu() callback alongside the struct free.

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patch to fix the use-after-free vulnerability
• Update Linux kernel to the latest version
• Monitor Linux kernel updates and apply patches promptly
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected products. The Linux kernel project has also provided information on the fix through their Git repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.