CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback
A race condition in the Linux kernel SUNRPC TLS handshake allows a use-after-free, potentially causing system crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89536?
CVE-2026-89536 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: wait for in-flight client TLS handshake callback
xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel().
handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference.
If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.
Which versions are affected by CVE-2026-89536?
How do I fix CVE-2026-89536?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89536 being exploited?
There is no known exploitation of CVE-2026-89536 in the wild and no public exploit code.
Sources
Also known as AZL-100475, BELL-CVE-2026-89536, DEBIAN-CVE-2026-89536, GHSA-fhrg-h295-8p3m, UBUNTU-CVE-2026-89536.