---
id: CVE-2026-89545
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sunrpc: defer rq_argp and rq_resp free until after RCU grace period

  svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously
  via kfree(), but defers the r…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sunrpc: defer rq_argp and rq_resp free until after RCU grace period

  svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously
  via kfree(), but defers the r…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-366
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 812443865c5fc255363d4a684a62c086af1addca <
    0ea49d69aa806008b2424c8cf21cf746b9963967
  - >-
    Linux >= 812443865c5fc255363d4a684a62c086af1addca <
    08bc49e0541260bf294962cf889a32a2d2713ad6
  - >-
    Linux >= 812443865c5fc255363d4a684a62c086af1addca <
    e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090
  - >-
    Linux >= 812443865c5fc255363d4a684a62c086af1addca <
    c479bde671cbe2f9e152834a8b0eb7c3c295bbaf
  - Linux 3.19
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:23.150'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89545'
references:
  - url: 'https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89545.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89545'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532164'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89545'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89545'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.0017
epssPercentile: 0.05574
scores:
  nvd: 7.8
  cna: 7.8
  vendor: 6.6
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: defer rq_argp and rq_resp free until after RCU grace period

svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously
via kfree(), but defers the rqstp struct free via kfree_rcu().  After
svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is
a window where RCU readers that started before list_del_rcu() can still
traverse the thread list and find the rqstp.  These readers (e.g.
nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has
already been freed — a use-after-free.

Fix this by moving the kfree of rq_argp and rq_resp into an explicit
call_rcu() callback alongside the struct free.  Resources not accessed
by RCU readers (bvec, buffer pages, scratch folio, auth_data) remain
synchronously freed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89545.json)