CVE-2026-90235

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the sunrpc xprtsock component where shared socket callbacks are handled using plain stores and loads. Specifically, when SUNRPC manages AF LOCAL, UDP, or TCP sockets and restores lower-socket callbacks during teardown, a race condition occurs because other CPUs may hold stale callback snapshots. This visibility gap allows the execution of xs data ready() or xs udp write space() even after the callback fields have been restored to the lower-socket handlers. The problem involves the sk data ready and sk write space variables, and the xs udp do set buffer size() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.