Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89540— sunrpc: init gssp_lock before publishing proc entry

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于sunrpc在proc_create_data发布/proc/net/rpc/use-gss-proxy后、init_gssp_clnt初始化gssp_lock前存在时间窗口，用户空间写入可对未初始化的互斥锁执行加锁操作，可能引发竞争条件，导致客户端资源被关闭或泄漏。

CVSS 7.8 · High EPSS 0.13% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 030d794bf49855f5e2a9e8dfbfad34211d1eb08b< 159a4fab7170badd6c4a553aef81cac079d6f4ee affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< b3526ae3351968f6726bcbe25d8d09973ad79109 affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< 7f5bcdc8da15077ebe846c2756a5a17741021410 affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< 89c8e0733e8c46b7973503f15b1b31a8587d8030 affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< f15b87521168c2a92cb1931f532cba422f856f01 affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< edeefb111d6181a4aa278f415b005efe284b9489 affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< 3f019571928b269feebcff59926ec13294215e0e affected
030d794bf49855f5e2a9e8dfbfad34211d1eb08b< 5ce1ed6159731a41fdd0b03eedbed4e147036a5a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89540

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sunrpc: init gssp_lock before publishing proc entry
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before init_gssp_clnt() runs mutex_init() on sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is immediately reachable from userspace, so a write that lands in the window drives set_gssp_clnt() into mutex_lock() on a zero-initialized struct mutex. create_use_gss_proxy_proc_entry(net) proc_create_data("use-gss-proxy", ...) /* dentry live */ init_gssp_clnt(sn) mutex_init(&sn->gssp_lock) /* too late */ write_gssp() set_gssp_clnt(net) mutex_lock(&sn->gssp_lock) /* uninitialized */ gssp_rpc_create(...) sn->gssp_clnt = clnt mutex_unlock(&sn->gssp_lock) The window spans only the two statements between proc_create_data() returning and init_gssp_clnt(), so a writer reaches it only if the registering thread is preempted there while another task is already opening the freshly published file. register_pernet_subsys() runs in preemptible context under pernet_ops_rwsem, so that preemption is possible, and the window widens on auth_rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. A writer that wins the race locks a zero-filled struct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a "lock used without init" splat; on a production kernel the fast path acquires the lock via CMPXCHG(owner, 0, current). In the latter case a second writer that arrives before init_gssp_clnt() re-zeroes owner can enter set_gssp_clnt() concurrently, shut down the first writer's clnt while it is still in use, and leak the loser's clnt. Fix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime matches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from the kzalloc that backs net_generic storage, so the lazy helper is no longer needed; drop init_gssp_clnt(), its prototype, and the call from create_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time dependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on every netns before any auth_gss pernet init can publish the proc entry.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于sunrpc在proc_create_data发布/proc/net/rpc/use-gss-proxy后、init_gssp_clnt初始化gssp_lock前存在时间窗口，用户空间写入可对未初始化的互斥锁执行加锁操作，可能引发竞争条件，导致客户端资源被关闭或泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 030d794bf49855f5e2a9e8dfbfad34211d1eb08b ~ 159a4fab7170badd6c4a553aef81cac079d6f4ee -
Linux Linux 3.10 -

II. Public POCs for CVE-2026-89540

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89540

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89540 (8)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89674 9.8 CRITICAL nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89675 9.8 CRITICAL nfsd: fix UAF in async copy cancel and shutdown
CVE-2026-89676 9.8 CRITICAL nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
CVE-2026-89677 9.8 CRITICAL nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
CVE-2026-89681 9.8 CRITICAL nfsd: fix layout fence worker double-reference race
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89702 9.8 CRITICAL nfsd: size fh_verify server sockaddr slot by xpt_locallen
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89540

No comments yet

Leave a comment