sunrpc: init gssp_lock before publishing proc entry
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before init_gssp_clnt() runs mutex_init() on sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is immediately reachable from userspace, so a write that lands in the window drives set_gssp_clnt() into mutex_lock() on a zero-initialized struct mutex. create_use_gss_proxy_proc_entry(net) proc_create_data("use-gss-proxy", ...) /* dentry live */ init_gssp_clnt(sn) mutex_init(&sn->gssp_lock) /* too late */ write_gssp() set_gssp_clnt(net) mutex_lock(&sn->gssp_lock) /* uninitialized */ gssp_rpc_create(...) sn->gssp_clnt = clnt mutex_unlock(&sn->gssp_lock) The window spans only the two statements between proc_create_data() returning and init_gssp_clnt(), so a writer reaches it only if the registering thread is preempted there while another task is already opening the freshly published file. register_pernet_subsys() runs in preemptible context under pernet_ops_rwsem, so that preemption is possible, and the window widens on auth_rpcgss module load, when the proc entry is created for every live net namespace whose tasks are already running. A writer that wins the race locks a zero-filled struct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a "lock used without init" splat; on a production kernel the fast path acquires the lock via CMPXCHG(owner,
CVE-2026-89540
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89540
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "159a4fab7170badd6c4a553aef81cac079d6f4ee",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "b3526ae3351968f6726bcbe25d8d09973ad79109",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "7f5bcdc8da15077ebe846c2756a5a17741021410",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "89c8e0733e8c46b7973503f15b1b31a8587d8030",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "f15b87521168c2a92cb1931f532cba422f856f01",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "edeefb111d6181a4aa278f415b005efe284b9489",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "3f019571928b269feebcff59926ec13294215e0e",
"versionType": "git"
},
{
"status": "affected",
"version": "030d794bf49855f5e2a9e8dfbfad34211d1eb08b",
"lessThan": "5ce1ed6159731a41fdd0b03eedbed4e147036a5a",
"versionType": "git"
}
],
"programFiles": [
"net/sunrpc/auth_gss/gss_rpc_upcall.c",
"net/sunrpc/auth_gss/gss_rpc_upcall.h",
"net/sunrpc/auth_gss/svcauth_gss.c",
"net/sunrpc/sunrpc_syms.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.10",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sunrpc/auth_gss/gss_rpc_upcall.c",
"net/sunrpc/auth_gss/gss_rpc_upcall.h",
"net/sunrpc/auth_gss/svcauth_gss.c",
"net/sunrpc/sunrpc_syms.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89540
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #35058 · Revision 1
- Added to Heist Feed
- Publisher date