CVE-2026-89540

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: init gssp lock before publishing proc entry

create use gss proxy proc entry() publishes /proc/net/rpc/use-gss-proxy via proc create data() before init gssp clnt() runs mutex init() on sn->gssp lock. Once the dentry is linked under proc subdir lock it is immediately reachable from userspace, so a write that lands in the window drives set gssp clnt() into mutex lock() on a zero-initialized struct mutex.

create use gss proxy proc entry(net) proc create data("use-gss-proxy", ...) /* dentry live / init gssp clnt(sn) mutex init(&sn->gssp lock) / too late */

write gssp() set gssp clnt(net) mutex lock(&sn->gssp lock) /* uninitialized */ gssp rpc create(...) sn->gssp clnt = clnt mutex unlock(&sn->gssp lock)

The window spans only the two statements between proc create data() returning and init gssp clnt(), so a writer reaches it only if the registering thread is preempted there while another task is already opening the freshly published file. register pernet subsys() runs in preemptible context under pernet ops rwsem, so that preemption is possible, and the window widens on auth rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. A writer that wins the race locks a zero-filled struct mutex. On CONFIG DEBUG MUTEXES the missing magic value trips a "lock used without init" splat; on a production kernel the fast path acquires the lock via CMPXCHG(owner, 0, current). In the latter case a second writer that arrives before init gssp clnt() re-zeroes owner can enter set gssp clnt() concurrently, shut down the first writer's clnt while it is still in use, and leak the loser's clnt.

Fix by initializing sn->gssp lock in sunrpc init net() so its lifetime matches the sunrpc net it lives in. sn->gssp clnt is already NULL from the kzalloc that backs net generic storage, so the lazy helper is no longer needed; drop init gssp clnt(), its prototype, and the call from create use gss proxy proc entry(). sunrpc.ko is a build-time dependency of auth rpcgss.ko, so sunrpc init net() has always run on every netns before any auth gss pernet init can publish the proc entry.