Answer in brief
CVE-2026-89548 records a High severity (CVSS 7.8) vulnerability in SUNRPC: always drain cache_cleaner before destroying a cache_detail. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <9d44836f60c8c29bcdb1471fd9202387c642a890 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <2e861ce2aaa468351a6a47c4cbb4971ebb740c7b || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <3d60fdf951143d6ef4e352e2f8eb852286701726 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <f42d0fda0c67695db6bc704b04b7c10240805377 | 9d44836f60c8c29bcdb1471fd9202387c642a890, 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b, 3d60fdf951143d6ef4e352e2f8eb852286701726, f42d0fda0c67695db6bc704b04b7c10240805377 |
| Linux/Linuxgeneric | 3.4 | Not reported |
| Linux/Linuxgeneric | >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <dec787a15c96a5665e9ffc61b429a6a4ab26e6b9 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <5eea874a696201c31e7c2d7badbfa0d90e9961b5 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <cf239de7fdcc8336259b01ea4bcf650dadad1040 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <6d74ecc2be120a0c300b224b7649fe93c0453714 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <9d44836f60c8c29bcdb1471fd9202387c642a890 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <2e861ce2aaa468351a6a47c4cbb4971ebb740c7b || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <3d60fdf951143d6ef4e352e2f8eb852286701726 || >=820f9442e711a81749e70c40f149fc54c4ce0ca8 <f42d0fda0c67695db6bc704b04b7c10240805377 | dec787a15c96a5665e9ffc61b429a6a4ab26e6b9, 5eea874a696201c31e7c2d7badbfa0d90e9961b5, cf239de7fdcc8336259b01ea4bcf650dadad1040, 6d74ecc2be120a0c300b224b7649fe93c0453714, 9d44836f60c8c29bcdb1471fd9202387c642a890, 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b, 3d60fdf951143d6ef4e352e2f8eb852286701726, f42d0fda0c67695db6bc704b04b7c10240805377 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put as a function pointer from freed slab. Drop the list_empty guard so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before the cache_detail is freed. Re-arm the cleaner afterwards if other caches are still registered.
Quoted source text, attributed separately from HOL analysis.