CVE-2026-89543sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Official description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/1a713814e0580f946196bca5e340b37991c6e8bf
• https://git.kernel.org/stable/c/f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd
• https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3
• https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
• https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c
• https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2