CVE-2026-89536

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SUNRPC component where a race condition occurs during the client TLS handshake. The function xs tls handshake sync() provides a reference to the lower transport to xs tls handshake done() before submitting a handshake request. If a timeout or signal occurs, the synchronous waiter calls tls handshake cancel() and drops that reference. However, if handshake req cancel() returns false because handshake complete() has already marked the request as complete, the completion callback may still be executing. This can lead to the lower transport being freed before xs tls handshake done() can store xprt err or release its own reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.