CVE-2026-89545 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and security teams should be aware of the vulnerability and its potential impact. They should review Linux kernel versions for potential exposure, verify if the Linux kernel patch is applied, and monitor for potential exploitation attempts. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Why it matters

A use-after-free vulnerability in the Linux kernel's sunrpc module requires verification of patch application and monitoring for potential exploitation attempts.

• Verify Linux kernel patch application to prevent potential use-after-free
• Monitor for potential exploitation attempts to detect possible attacks

Technical summary

The Linux kernel's sunrpc module has a use-after-free vulnerability. svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously, but defers the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can still traverse the thread list and find the rqstp, leading to a potential use-after-free. The vulnerability requires verification of patch application and monitoring for potential exploitation attempts without unsupported root-cause or exploit claims. Affected product context and defensive impact should be considered.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions for potential exposure
• Verify if the Linux kernel patch is applied
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions of the Linux kernel are affected or provide a patch. The Linux kernel Git repository provides three commits that address the issue. Defenders should verify Linux kernel patch application to prevent potential use-after-free and monitor for potential exploitation attempts to detect possible attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.