CVE-2026-89543

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the sunrpc component. The mount-event path in the rpc clnt handle event() function calls rpc setup pipedir sb() directly without refreshing the clnt->pipefs sb field. Additionally, the umount path removes the directory without clearing clnt->pipefs sb. Following a late pipefs mount or remount, the rpc clnt remove pipedir() function compares the current superblock against a stale pipefs sb pointer and skips cleanup. This leaves pipefs dentries with inode private data pointing to a freed rpc clnt, which can lead to a use-after-free during subsequent calls to rpc info open() or rpc show info() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.