CVE-2026-89548

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SUNRPC component. The function sunrpc destroy cache detail() only cancels the global cache cleaner delayed work when the cache list is empty. During per-netns teardown, the cache list is never empty because caches for init net remain registered, preventing the cancellation from triggering. Consequently, cache destroy net() may free the cache detail while cache clean() still holds a dangling pointer to it. This leads to a use-after-free scenario where cache dequeue() attempts to acquire cd->queue lock on freed memory, and cache put() dereferences cd->cache put as a function pointer from a freed slab.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.