CVE-2026-90235: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE
xprtsock replaces and restores sk->skdataready and sk->skwritespace on live sockets with plain stores, and xsudpdosetbuffersize() invokes sk->skwritespace via a plain load. These callback pointers are shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs the same READONCE()/WRITEONCE() callback visibility contract that the validated 4022 family applied elsewhere.
When SUNRPC takes over an AFLOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot can still invoke xsdataready() or xsudpwritespace() after the live callback fields have already been restored to the lower-socket handlers.
Use WRITEONCE() for the shared skdataready and skwritespace stores in xslocalfinishconnecting(), xsudpfinishconnecting(), xstcpfinishconnecting(), and xsrestoreoldcallbacks(). Use READONCE() for the direct skwritespace invocation in xsudpdosetbuffersize(). This matches the required callback visibility contract while leaving adjacent skstatechange and skerrorreport handling unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Configuration
Use READ_ONCE() for the direct sk_write_space invocation in xs_udp_do_set_buffer_size(), and use WRITE_ONCE() for sk_data_ready and sk_write_space stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and xs_restore_old_callbacks().
Linux kernel sunrpc xprtsock Shared socket callback access = READ_ONCE()/WRITE_ONCE()
Event History
Frequently Asked Questions
Which socket types are involved?
The affected callback handling applies when SUNRPC takes over AF_LOCAL, UDP, or TCP sockets and later restores the lower-socket callbacks during teardown.
What conditions are needed for the race to occur?
Another CPU must concurrently read or invoke the shared socket callbacks while xprtsock replaces or restores sk_data_ready or sk_write_space. A CPU can retain an earlier callback snapshot and invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have been restored.
Can the affected kernel versions be identified from this information?
No affected version range is provided. The listed stable kernel commits are the available remediation references.