UBUNTU-CVE-2026-89545: Use After Free
In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree() frees rqstp->rqargp and rqstp->rqresp synchronously via kfree(), but defers the rqstp struct free via kfreercu(). After svcexitthread() calls listdelrcu() and svcrqstfree(), there is a window where RCU readers that started before listdelrcu() can still traverse the thread list and find the rqstp. These readers (e.g. nfsdnlrpcstatusgetdumpit()) dereference rqstp->rqargp, which has already been freed — a use-after-free. Fix this by moving the kfree of rqargp and rqresp into an explicit callrcu() callback alongside the struct free. Resources not accessed by RCU readers (bvec, buffer pages, scratch folio, authdata) remain synchronously freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change svc_rqst_free() to move the kfree operations for rqstp->rq_argp and rqstp->rq_resp into an explicit call_rcu() callback alongside freeing the rqstp struct, so RCU readers cannot access them after they are freed.
Event History
Frequently Asked Questions
Which systems are most likely exposed to this issue?
Systems running one of the listed Ubuntu Linux kernel packages are in scope. The vulnerable path involves SunRPC service threads and an RCU reader such as the NFS server RPC-status netlink dump handler, so exposure is most relevant where those kernel service and status-query paths are used.
What conditions are needed to trigger the use-after-free?
A service request thread must exit and be removed with list_del_rcu(), while an RCU reader that began before that removal still traverses the thread list and dereferences the request's rq_argp or rq_resp fields. Exploitation requires local access with low privileges according to the supplied vector.
What is the impact of a successful trigger?
The flaw can cause a use-after-free when an RCU reader accesses request argument or response memory after it has been freed. The provided severity vector indicates high availability impact and low confidentiality impact, with no indicated integrity impact.
What does the fix change?
The fix defers freeing rq_argp and rq_resp until an RCU grace period has completed, using an explicit call_rcu() callback with the request structure free. Other request resources not accessed by RCU readers continue to be freed synchronously.