CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: always drain cache cleaner before destroying a cache detail

sunrpc destroy cache detail() only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty because init net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache destroy net() which kfrees the cache detail while cache clean() may still hold a dangling pointer to it. The result is a use-after-free: cache dequeue() takes cd->queue lock on freed memory, and cache put() dereferences cd->cache put as a function pointer from freed slab.

Drop the list empty guard so that cancel delayed work sync() always runs, ensuring any in-flight cache clean() completes before the cache detail is freed. Re-arm the cleaner afterwards if other caches are still registered.