CVE-2026-90235 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of the Linux kernel who may be affected by this vulnerability. Affected operator, platform, vulnerability-management, and security-team impact should be considered when reviewing this vulnerability. Verify callback visibility contract for sunrpc module and Update Linux kernel to latest version.

Why it matters

A critical vulnerability has been resolved in the Linux kernel, specifically in the sunrpc module. The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service. Linux kernel developers and maintainers should review and apply the patches provided by the Linux kernel maintainers.

• Verify callback visibility contract for sunrpc module
• Update Linux kernel to latest version
• Monitor system for suspicious activity

Technical summary

The vulnerability was caused by a plain store and load of shared socket callbacks in the sunrpc module of the Linux kernel. This could lead to a stale callback snapshot being invoked after the live callback fields have been restored to the lower-socket handlers. The vulnerability was resolved by using WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores, and READ_ONCE() for the direct sk_write_space invocation. This ensures that the callback visibility contract is met, preventing a stale snapshot from being invoked. Linux kernel developers and maintainers should review and apply the patches provided by the Linux kernel maintainers.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to the latest version.
• Monitor the system for any suspicious activity.
• Verify callback visibility contract for sunrpc module
• Update Linux kernel to latest version
• Monitor system for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was resolved by using WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores, and READ_ONCE() for the direct sk_write_space invocation. This ensures that the callback visibility contract is met, preventing a stale snapshot from being invoked.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.