---
id: CVE-2026-89548
title: 'SUNRPC: always drain cache_cleaner before destroying a cache_detail'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  SUNRPC: always drain cache_cleaner before destroying a cache_detail

  sunrpc_destroy_cache_detail() only cancels the global cache_cleaner
  delayed_work when cache_list is…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    dec787a15c96a5665e9ffc61b429a6a4ab26e6b9
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    5eea874a696201c31e7c2d7badbfa0d90e9961b5
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    cf239de7fdcc8336259b01ea4bcf650dadad1040
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    6d74ecc2be120a0c300b224b7649fe93c0453714
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    9d44836f60c8c29bcdb1471fd9202387c642a890
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    2e861ce2aaa468351a6a47c4cbb4971ebb740c7b
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    3d60fdf951143d6ef4e352e2f8eb852286701726
  - >-
    Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 <
    f42d0fda0c67695db6bc704b04b7c10240805377
  - Linux 3.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:23:39.938577Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:48:41.057Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89548'
references:
  - url: 'https://git.kernel.org/stable/c/dec787a15c96a5665e9ffc61b429a6a4ab26e6b9'
  - url: 'https://git.kernel.org/stable/c/5eea874a696201c31e7c2d7badbfa0d90e9961b5'
  - url: 'https://git.kernel.org/stable/c/cf239de7fdcc8336259b01ea4bcf650dadad1040'
  - url: 'https://git.kernel.org/stable/c/6d74ecc2be120a0c300b224b7649fe93c0453714'
  - url: 'https://git.kernel.org/stable/c/9d44836f60c8c29bcdb1471fd9202387c642a890'
  - url: 'https://git.kernel.org/stable/c/2e861ce2aaa468351a6a47c4cbb4971ebb740c7b'
  - url: 'https://git.kernel.org/stable/c/3d60fdf951143d6ef4e352e2f8eb852286701726'
  - url: 'https://git.kernel.org/stable/c/f42d0fda0c67695db6bc704b04b7c10240805377'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89548.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89548'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532450'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89548'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89548'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89548.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00126
epssPercentile: 0.02231
scores:
  cna: 7.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.452Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: always drain cache_cleaner before destroying a cache_detail

sunrpc_destroy_cache_detail() only cancels the global cache_cleaner
delayed_work when cache_list is empty.  During per-netns teardown
cache_list is never empty because init_net's caches remain registered,
so the cancel never fires.  After unlink, the caller proceeds to
cache_destroy_net() which kfrees the cache_detail while cache_clean()
may still hold a dangling pointer to it.  The result is a
use-after-free: cache_dequeue() takes cd->queue_lock on freed memory,
and cache_put() dereferences cd->cache_put as a function pointer from
freed slab.

Drop the list_empty guard so that cancel_delayed_work_sync() always
runs, ensuring any in-flight cache_clean() completes before the
cache_detail is freed.  Re-arm the cleaner afterwards if other caches
are still registered.

## Affected

- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < dec787a15c96a5665e9ffc61b429a6a4ab26e6b9`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < 5eea874a696201c31e7c2d7badbfa0d90e9961b5`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < cf239de7fdcc8336259b01ea4bcf650dadad1040`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < 6d74ecc2be120a0c300b224b7649fe93c0453714`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < 9d44836f60c8c29bcdb1471fd9202387c642a890`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < 2e861ce2aaa468351a6a47c4cbb4971ebb740c7b`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < 3d60fdf951143d6ef4e352e2f8eb852286701726`
- `Linux >= 820f9442e711a81749e70c40f149fc54c4ce0ca8 < f42d0fda0c67695db6bc704b04b7c10240805377`
- `Linux 3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89548.json)