CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix use-after-free in rpc clnt handle event and rpc clnt remove pipedir

Normal client creation goes through rpc setup pipedir(), which records clnt->pipefs sb, but the mount-event path in rpc clnt handle event() calls rpc setup pipedir sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs sb.

After a late pipefs mount or any remount, rpc clnt remove pipedir() compares the current superblock against a stale pipefs sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc clnt, leading to a potential use-after-free during subsequent rpc info open() or rpc show info() calls.

Fix this by properly updating clnt->pipefs sb upon mount events and clearing it during unmount or failure paths.